PT-2011-2326 · Phpgedview · Phpgedview

Dun · Publicado 2011-01-11 · Atualizado 2017-08-17 · CVE-2011-0405

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhpGedView version 4.2.3

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the module.php file when magic quotes gpc is disabled. This can be achieved by using directory traversal sequences in the pgvaction parameter.

Recommendations For PhpGedView version 4.2.3, consider disabling the module.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent directory traversal attacks. Avoid using the pgvaction parameter in the affected module until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-0405

Produtos afetados

Phpgedview

Referências · 10

• 🔥 http://exploit-db.com/exploits/15913 · Exploit
• 🔥 http://sourceforge.net/projects/phpgedview/forums/forum/185166/topic/4040059 · Exploit
• 🔥 https://exploit-db.com/exploits/15913 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0405 · Nota de Segurança
• http://osvdb.org/70295 · Nota
• http://securityfocus.com/bid/45674 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64733 · Nota
• http://vupen.com/english/advisories/2011/0036 · Aviso do Fabricante
• http://sourceforge.net/tracker/?func=detail&aid=3152857&group_id=55456&atid=477081 · Correção
• http://secunia.com/advisories/42786 · Aviso do Fabricante