PT-2014-4291 · Skybluecanvas · Skybluecanvas Cms

Publicado 2014-01-29 · Atualizado 2017-08-29 · CVE-2014-1683

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SkyBlueCanvas CMS versions prior to 1.1 r248-04

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the name, email, subject, or message parameter to "index.php" when the pid parameter is 4. This is due to a problem in the bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php.

Recommendations For SkyBlueCanvas CMS versions prior to 1.1 r248-04, update to version 1.1 r248-04 or later to resolve the issue. As a temporary workaround, consider restricting access to the bashMail function in the contacts module to minimize the risk of exploitation. Avoid using the name, email, subject, or message parameters in the affected "index.php" endpoint when the pid parameter is 4 until the issue is resolved.

Exploit

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2014-1683

Produtos afetados

Skybluecanvas Cms

Referências · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/skybluecanvas_exec.rb · Exploit
• 🔥 http://exploit-db.com/exploits/31183 · Exploit
• 🔥 https://exploit-db.com/exploits/31432 · Exploit
• 🔥 http://exploit-db.com/exploits/31432 · Exploit
• 🔥 https://exploit-db.com/exploits/31183 · Exploit
• http://secunia.com/advisories/56646 · Nota
• http://seclists.org/fulldisclosure/2014/Jan/159 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1683 · Nota de Segurança
• http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html · Nota
• http://securityfocus.com/bid/65129 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90670 · Nota