PT-2013-6290 · Iscripts · Iscripts Autohoster

0U7 5M4R7 · Publicado 2013-12-20 · Atualizado 2017-08-29 · CVE-2013-7190

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions iScripts AutoHoster version 2.4

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files via specific parameters in various PHP files. The affected parameters include tmpid in "websitebuilder/showtemplateimage.php", fname in "admin/downloadfile.php", and id in "support/admin/csvdownload.php". Additionally, there is an unspecified impact via unspecified vectors in "support/parser/main smtp.php".

Recommendations For iScripts AutoHoster version 2.4, consider restricting access to the vulnerable parameters tmpid, fname, and id in their respective PHP files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints. Also, restrict access to "support/parser/main smtp.php" to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2013-7190

Produtos afetados

Iscripts Autohoster

Referências · 7

• 🔥 https://exploit-db.com/exploits/38891 · Exploit
• 🔥 https://exploit-db.com/exploits/38892 · Exploit
• 🔥 https://exploit-db.com/exploits/38889 · Exploit
• 🔥 https://exploit-db.com/exploits/38890 · Exploit
• http://seclists.org/fulldisclosure/2013/Dec/121 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89818 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7190 · Nota de Segurança