PT-2014-6292 · Dirphp · Dirphp

Black Hat · Publicado 2014-07-29 · Atualizado 2014-08-27 · CVE-2014-5115

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DirPHP version 1.0

Description The issue allows remote attackers to read arbitrary files by providing a full pathname in the phpfile parameter to the "index.php" endpoint.

Recommendations For DirPHP version 1.0, consider restricting access to the phpfile parameter in the "index.php" endpoint to prevent arbitrary file reading until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-5115

Produtos afetados

Dirphp

Referências · 4

• 🔥 https://exploit-db.com/exploits/34173 · Exploit
• 🔥 http://exploit-db.com/exploits/34173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5115 · Nota de Segurança
• http://packetstormsecurity.com/files/127642/DirPHP-1.0-Local-File-Inclusion.html · Nota