PT-2007-3194 · Apache · Apache Http Server

Gold_M · Published 2007-04-03 · Updated 2017-10-11 · CVE-2007-1842

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: JSBoard versions prior to 2.0.12

Description: A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files by injecting a .. (dot dot) in the table parameter of the login.php file. This can be used to inject PHP sequences into an Apache HTTP Server log file.

Recommendations: For versions prior to 2.0.12, update to version 2.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the login.php file to minimize the risk of exploitation. Avoid using the table parameter in the login.php file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-1842

Affected Products

Apache Http Server

References · 8

• 🔥 http://kldp.net/plugins/scmcvs/cvsweb.php/jsboard-2/login.php.diff?r1=1.8;r2=1.9;cvsroot=jsboard · Exploit
• 🔥 http://securityfocus.com/bid/23223 · Exploit
• 🔥 https://exploit-db.com/exploits/3614 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1842 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33338 · Note
• http://vupen.com/english/advisories/2007/1182 · Note
• http://kldp.net/plugins/scmcvs/cvsweb.php/jsboard-2/login.php.diff?r1=1.8%3Br2=1.9%3Bcvsroot=jsboard · Note
• http://osvdb.org/37365 · Note