PT-2003-1182 · Achievo · Achievo

Published 2003-04-11 · Updated 2008-09-05 · CVE-2002-1435

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Achievo versions 0.7.0 through 0.9.1, except version 0.8.2

Description The issue allows remote attackers to execute arbitrary PHP code when the 'allow url fopen' setting is enabled. This is achieved via a URL in the config atkroot parameter that points to the code.

Recommendations For Achievo versions 0.7.0 through 0.9.1, except version 0.8.2, consider disabling the allow url fopen setting to prevent exploitation. Additionally, restrict access to the config atkroot parameter to minimize the risk of arbitrary PHP code execution.

Exploit

Fix

Related Identifiers

CVE-2002-1435

Affected Products

Achievo

References · 6

• 🔥 https://exploit-db.com/exploits/21745 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-08/0235.html · Exploit
• 🔥 http://securityfocus.com/bid/5552 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1435 · Security Note
• http://iss.net/security_center/static/9947.php · Vendor Advisory
• http://achievo.org/lists/2002/Aug/msg00092.html · Note