PT-2007-3916 · Telltarget · Telltarget Cms

Gold_M · Published 2007-05-11 · Updated 2017-10-11 · CVE-2007-2597

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions telltarget CMS version 1.3.3

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in several parameters, including the ordnertiefe parameter to site conf.php, and the tt docroot parameter to various PHP files in different directories, such as class.csv.php, produkte nach serie.php, ref kd rubrik.php, hg referenz jobgalerie.php, surfer anmeldung NWL.php, produkte nach serie alle.php, surfer aendern.php, referenz.php, 1/lay.php, and 3/lay.php. This can be achieved by manipulating the ordnertiefe and tt docroot parameters.

Recommendations For telltarget CMS version 1.3.3, consider disabling the ordnertiefe parameter to site conf.php and the tt docroot parameter to the affected PHP files until a patch is available. Restrict access to the vulnerable PHP files in the functionen/, module/, and standard/ directories to minimize the risk of exploitation. Avoid using the ordnertiefe and tt docroot parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-2597

Affected Products

Telltarget Cms

References · 17

• 🔥 https://exploit-db.com/exploits/3885 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2597 · Security Note
• http://securityfocus.com/bid/23903 · Note
• http://osvdb.org/38246 · Note
• http://osvdb.org/38239 · Note
• http://osvdb.org/38237 · Note
• http://osvdb.org/38241 · Note
• http://osvdb.org/38242 · Note
• http://osvdb.org/38247 · Note
• http://osvdb.org/38236 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34216 · Note
• http://osvdb.org/38244 · Note
• http://osvdb.org/38245 · Note
• http://osvdb.org/38243 · Note
• http://vupen.com/english/advisories/2007/1740 · Note