PT-2010-3377 · Gallo · Gallo

Cr4Wl3R · Publicado 2010-05-06 · Atualizado 2010-05-07 · CVE-2010-1737

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Gallo version 0.1.0

Description The issue allows remote attackers to execute arbitrary PHP code when magic quotes gpc is disabled. This is achieved via a URL in the config[gfwroot] parameter.

Recommendations For Gallo version 0.1.0, consider disabling the use of the config[gfwroot] parameter until a patch is available, or enable magic quotes gpc to prevent the execution of arbitrary PHP code.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-1737

Produtos afetados

Gallo

Referências · 7

• 🔥 https://exploit-db.com/exploits/12488 · Exploit
• 🔥 http://packetstormsecurity.org/1005-exploits/gallo-rfi.txt · Exploit
• 🔥 http://securityfocus.com/bid/39890 · Exploit
• 🔥 http://exploit-db.com/exploits/12488 · Exploit
• http://vupen.com/english/advisories/2010/1060 · Aviso do Fabricante
• http://secunia.com/advisories/39706 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1737 · Nota de Segurança