PT-2005-1783 · Webinsta · Webinsta Mailing List Manager

Published 2005-03-10 · Updated 2017-07-11 · CVE-2005-0748

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WEBInsta Mailing list manager version 1.3d

Description The issue allows remote attackers to execute arbitrary PHP code by modifying the absolute path parameter to reference a URL on a remote web server that contains the code. This is a result of a remote file inclusion vulnerability in the initdb.php file.

Recommendations For WEBInsta Mailing list manager version 1.3d, avoid using the absolute path parameter to reference external URLs until a fix is available. As a temporary workaround, consider restricting access to the initdb.php file to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2005-0748

Affected Products

Webinsta Mailing List Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-0748 · Security Note
• http://vupen.com/english/advisories/2005/0248 · Vendor Advisory
• http://securitytracker.com/id?1013409 · Vendor Advisory
• http://secunia.com/advisories/14550 · Vendor Advisory
• http://securityfocus.com/bid/12773 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19651 · Note