PT-2005-3573 · Savewebportal · Savewebportal

Published 2005-08-24 · Updated 2017-07-11 · CVE-2005-2687

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SaveWebPortal version 3.4

Description A remote file inclusion issue allows remote attackers to execute arbitrary PHP code. This can be achieved via the SITE Path parameter to "menu dx.php" or the CONTENTS Dir parameter to "menu sx.php".

Recommendations For SaveWebPortal version 3.4, as a temporary workaround, consider restricting access to the menu dx.php and menu sx.php endpoints until a patch is available. Avoid using the SITE Path and CONTENTS Dir parameters in these endpoints to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-2687

Affected Products

Savewebportal

References · 4

• 🔥 http://rgod.altervista.org/save_yourself_from_savewebportal34.html · Exploit
• 🔥 http://secunia.com/advisories/16522 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2687 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28182 · Note