PT-2011-2404 · Zwii · Zwii

Abdi Mohamed · Publicado 2011-01-20 · Atualizado 2017-08-17 · CVE-2011-0505

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zwii version 2.1.1

Description A directory traversal issue exists when magic quotes gpc is disabled and register globals is enabled, allowing remote attackers to include and execute arbitrary local files via directory traversal sequences in the set[template][value] parameter.

Recommendations For Zwii version 2.1.1, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the system/system.php file to minimize the risk of arbitrary file inclusion. Avoid using the set[template][value] parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-0505

Produtos afetados

Zwii

Referências · 8

• 🔥 https://exploit-db.com/exploits/15945 · Exploit
• 🔥 http://exploit-db.com/exploits/15945 · Exploit
• 🔥 http://securityfocus.com/bid/45736 · Exploit
• http://osvdb.org/70395 · Nota
• http://vupen.com/english/advisories/2011/0072 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64557 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0505 · Nota de Segurança
• http://secunia.com/advisories/42858 · Aviso do Fabricante