PT-2012-3126 · Base · Basic Analysis/Security Engine

Publicado 2012-02-18 · Atualizado 2017-08-29 · CVE-2012-1199

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine (BASE) version 1.4.5

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in various parameters, including the BASE path parameter to multiple PHP files, the GLOBALS[user session path] parameter to includes/base state common.inc.php, the BASE Language parameter to setup/base conf contents.php, or the ado inc php parameter to setup/setup2.php. This can be achieved by manipulating API endpoints such as base ag main.php, base db setup.php, base graph common.php, and others.

Recommendations For Basic Analysis and Security Engine (BASE) version 1.4.5, consider disabling the vulnerable parameters, such as BASE path, GLOBALS[user session path], BASE Language, and ado inc php, until a patch is available. Restrict access to the affected PHP files, including base ag main.php, base db setup.php, base graph common.php, and others, to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-1199

Produtos afetados

Basic Analysis/Security Engine

Referências · 43

• 🔥 https://exploit-db.com/exploits/36704 · Exploit
• 🔥 https://exploit-db.com/exploits/36711 · Exploit
• 🔥 https://exploit-db.com/exploits/36753 · Exploit
• 🔥 https://exploit-db.com/exploits/36759 · Exploit
• 🔥 https://exploit-db.com/exploits/36717 · Exploit
• 🔥 https://exploit-db.com/exploits/36720 · Exploit
• 🔥 https://exploit-db.com/exploits/36709 · Exploit
• 🔥 https://exploit-db.com/exploits/36713 · Exploit
• 🔥 http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html · Exploit
• 🔥 https://exploit-db.com/exploits/36732 · Exploit
• 🔥 https://exploit-db.com/exploits/36707 · Exploit
• 🔥 https://exploit-db.com/exploits/36757 · Exploit
• 🔥 https://exploit-db.com/exploits/36730 · Exploit
• 🔥 https://exploit-db.com/exploits/36723 · Exploit
• 🔥 https://exploit-db.com/exploits/36729 · Exploit