PT-2007-2579 · Unknown · Pyrophobia

Published 2007-02-27 · Updated 2017-10-11 · CVE-2007-1152

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pyrophobia version 2.1.3.1

Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the act or pid parameter to the "index.php" endpoint, or the action parameter to "admin/index.php".

Recommendations For Pyrophobia version 2.1.3.1, as a temporary workaround, consider restricting access to the act, pid, and action parameters in the affected endpoints until a patch is available. Avoid using the act and pid parameters in the top-level "index.php" endpoint and the action parameter in "admin/index.php" to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-1152

Affected Products

Pyrophobia

References · 6

• 🔥 https://exploit-db.com/exploits/8095 · Exploit
• 🔥 https://exploit-db.com/exploits/29632 · Exploit
• 🔥 http://securityfocus.com/bid/22667 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1152 · Security Note
• http://osvdb.org/37398 · Note
• http://securityfocus.com/bid/33861 · Note