PT-2010-3312 · Help Center Live · Help Center Live

41.W4R10R · Publicado 2010-04-30 · Atualizado 2010-05-03 · CVE-2010-1652

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Help Center Live versions 2.0.6 through 2.1.7

Description The issue allows remote attackers to read arbitrary files and possibly have other impacts via a .. (dot dot) in the file parameter to "module.php".

Recommendations For versions 2.0.6 and 2.1.7, consider restricting access to the module.php file until a fix is available. As a temporary workaround, avoid using the file parameter in the module.php file to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-1652

Produtos afetados

Help Center Live

Referências · 7

• 🔥 http://securityfocus.com/bid/39732 · Exploit
• 🔥 http://packetstormsecurity.org/1004-exploits/helpcenterlive-lfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/12421 · Exploit
• 🔥 http://exploit-db.com/exploits/12421 · Exploit
• http://secunia.com/advisories/39615 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1009 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1652 · Nota de Segurança