PT-2003-2132 · Unknown · Advanced Poll

Published 2003-12-31 · Updated 2017-07-11 · CVE-2003-1180

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Advanced Poll version 2.0.2

Description A directory traversal issue allows remote attackers to read arbitrary files or inject arbitrary local PHP files via .. sequences in the base path or pollvars[lang] parameters to various admin files, including "index.php", "admin tpl new.php", "admin tpl misc new.php", "admin templates misc.php", "admin templates.php", "admin stats.php", "admin settings.php", "admin preview.php", "admin password.php", "admin logout.php", "admin license.php", "admin help.php", "admin embed.php", "admin edit.php", or "admin comment.php".

Recommendations For Advanced Poll version 2.0.2, consider restricting access to the vulnerable admin files until a patch is available. As a temporary workaround, avoid using the base path and pollvars[lang] parameters in the affected admin files. Restrict access to the admin directory to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2003-1180

Affected Products

Advanced Poll

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-1180 · Security Note
• http://secunia.com/advisories/10068 · Vendor Advisory
• http://securityfocus.com/archive/1/342493 · Note
• http://securityfocus.com/bid/8890 · Note
• http://osvdb.org/3291 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13514 · Note