PT-2007-1543 · Openpinboard · Openpinboard

Published 2007-01-04 · Updated 2024-08-07 · CVE-2007-0050

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenPinboard version 2.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the language parameter in index.php. However, it has been disputed by the developer and a third party, as the variable is set before use. There is a small time window of risk before the installation is complete.

Recommendations For OpenPinboard version 2.0, consider restricting access to the index.php file until the issue is resolved, and ensure the language parameter is properly validated to prevent arbitrary PHP code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0050

Affected Products

Openpinboard

References · 6

• 🔥 http://securityfocus.com/archive/1/455818/100/0/threaded · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0050 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2007-01/0176.html · Note
• https://t.me/cvenotify/89617 · Telegram Post
• http://osvdb.org/33375 · Note
• http://securityfocus.com/archive/1/455795/100/0/threaded · Note