PT-2004-1319 · Phpgedview · Phpgedview

Published 2004-03-03 · Updated 2017-10-10 · CVE-2004-0128

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpGedView versions 2.65.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code by modifying the PGV BASE DIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script. This enables attackers to execute malicious code on the server.

Recommendations For phpGedView versions 2.65.1 and earlier, consider restricting access to the GEDCOM configuration script until a fix is available. As a temporary workaround, avoid using the PGV BASE DIRECTORY parameter to reference external URLs.

Exploit

Fix

Related Identifiers

CVE-2004-0128

Affected Products

Phpgedview

References · 8

• 🔥 http://securityfocus.com/bid/9531 · Exploit
• 🔥 http://securityfocus.com/archive/1/352355 · Exploit
• 🔥 https://exploit-db.com/exploits/23617 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0128 · Security Note
• http://sourceforge.net/project/shownotes.php?release_id=141517 · Vendor Advisory
• http://secunia.com/advisories/10753 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14987 · Note
• http://osvdb.org/3769 · Note