PT-2002-1755 · B2 · B2

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0734

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions B2 versions 2.0.6pre2 and earlier

Description The issue arises from the improper loading of the b2config.php file in certain configurations by the b2edit.showposts.php script. This allows remote attackers to execute arbitrary PHP code by manipulating the $b2inc variable to point to a malicious program stored on a remote server.

Recommendations For B2 versions 2.0.6pre2 and earlier, ensure the b2config.php file is properly loaded and secured to prevent remote attackers from manipulating the $b2inc variable. Consider restricting access to the b2edit.showposts.php script until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-0734

Affected Products

B2

References · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-05/0027.html · Exploit
• 🔥 https://exploit-db.com/exploits/21436 · Exploit
• 🔥 http://securityfocus.com/bid/4673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0734 · Security Note
• http://iss.net/security_center/static/9013.php · Vendor Advisory
• http://cafelog.com · Vendor Advisory