PT-2010-2822 · Advertisementmanager · Advertisementmanager

Publicado 2010-03-25 · Atualizado 2017-08-17 · CVE-2010-1106

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AdvertisementManager version 3.1.0

Description A remote file inclusion issue in cgi/index.php allows remote attackers to execute arbitrary PHP code via a URL in the req parameter. This can also be used to include and execute arbitrary local files using .. (dot dot) sequences.

Recommendations For AdvertisementManager version 3.1.0, consider restricting access to the cgi/index.php file and the req parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the req parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-1106

Produtos afetados

Advertisementmanager

Referências · 4

• 🔥 http://packetstormsecurity.com/1001-exploits/advertisemanager-xssrfitraversal.txt · Exploit
• 🔥 https://exploit-db.com/exploits/34849 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55756 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1106 · Nota de Segurança