PT-2005-3847 · Cutenews · Cutenews

Rgod · Published 2005-09-21 · Updated 2008-09-05 · CVE-2005-3010

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CuteNews versions 1.4.0 and earlier

Description A direct static code injection issue exists in the flood protection feature of CuteNews, allowing remote attackers to execute arbitrary PHP code. This is achieved by injecting malicious code via the HTTP CLIENT IP header, which is then inserted into data/flood.db.php.

Recommendations For CuteNews versions 1.4.0 and earlier, consider disabling the flood protection feature in inc/shows.inc.php until a patch is available to prevent exploitation. Restrict access to data/flood.db.php to minimize the risk of arbitrary PHP code execution. Avoid using the HTTP CLIENT IP header in the affected feature until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-3010

Affected Products

Cutenews

References · 5

• 🔥 http://securityfocus.com/bid/14869 · Exploit
• 🔥 http://securityfocus.com/archive/1/411057 · Exploit
• 🔥 https://exploit-db.com/exploits/1221 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3010 · Security Note
• http://securityreason.com/securityalert/14 · Note