PT-2013-5072 · Spip · Spip+1

Salvatore Bonaccorso

·

Publicado

2013-11-15

·

Atualizado

2016-12-08

·

CVE-2013-4557

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions SPIP versions 3.0.x prior to 3.0.12 SPIP Security Screen ( core /securite/ecran securite.php) version prior to 1.1.8
Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the connect parameter in the Security Screen component of SPIP.
Recommendations For SPIP versions 3.0.x prior to 3.0.12, update to version 3.0.12 or later. For SPIP Security Screen ( core /securite/ecran securite.php) version prior to 1.1.8, update to version 1.1.8 or later. As a temporary workaround, consider restricting access to the Security Screen component until a patch is applied.

Exploit

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-4557
DSA-2794-1

Produtos afetados

Spip
Spip Security Screen