PT-2012-2108 · Fcms · Family Connections Cms

Mr_Me · Publicado 2012-08-30 · Atualizado 2017-08-29 · CVE-2011-5130

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Family Connections CMS (FCMS) versions 2.5.0 through 2.7.1

Description The issue allows remote attackers to execute arbitrary commands. This is possible when the register globals setting is enabled, and shell metacharacters are used in the argv[1] parameter.

Recommendations For Family Connections CMS (FCMS) versions 2.5.0 through 2.7.1, consider disabling the register globals setting to prevent exploitation. Additionally, restrict the use of the argv[1] parameter in the dev/less.php file until a patch is available.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-5130

Produtos afetados

Family Connections Cms

Referências · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/familycms_less_exec.rb · Exploit
• 🔥 http://exploit-db.com/exploits/18198 · Exploit
• 🔥 http://sourceforge.net/apps/trac/fam-connections/ticket/407 · Exploit
• 🔥 https://exploit-db.com/exploits/18208 · Exploit
• 🔥 https://exploit-db.com/exploits/18198 · Exploit
• 🔥 http://exploit-db.com/exploits/18208 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5130 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5130 · Nota
• https://familycms.com/blog/2011/11/security-vulnerability-fcms-2-5-2-7-1 · Aviso do Fabricante
• http://osvdb.org/77492 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71618 · Nota
• http://secunia.com/advisories/47069 · Aviso do Fabricante