PT-2007-4001 · Jetbox · Jetbox Cms

Jesper Jurcenoks · Published 2007-05-21 · Updated 2018-10-16 · CVE-2007-2684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jetbox CMS version 2.1

Description The issue allows remote attackers to obtain sensitive information. This can be achieved through a direct request to certain PHP files, such as main page.php, open tree.php, and outputs.php. Additionally, a malformed view parameter to index.php can be used, potentially allowing SQL injection manipulation. The id[] parameter to admin/cms/opentree.php can also reveal the installation path in the resulting error message.

Recommendations For Jetbox CMS version 2.1, consider restricting access to the main page.php, open tree.php, and outputs.php files, as well as validating and sanitizing the view parameter in index.php to prevent SQL injection. Also, restrict the use of the id[] parameter in admin/cms/opentree.php to minimize the risk of path disclosure.

Exploit

Fix

Related Identifiers

CVE-2007-2684

Affected Products

Jetbox Cms

References · 10

• 🔥 http://marc.info/?l=full-disclosure&m=117974375029054&w=2 · Exploit
• 🔥 http://netvigilance.com/advisory0027 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2684 · Security Note
• http://osvdb.org/34790 · Note
• http://osvdb.org/34783 · Note
• http://securityfocus.com/archive/1/469222/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34385 · Note
• http://osvdb.org/34789 · Note
• http://osvdb.org/34787 · Note
• http://osvdb.org/34788 · Note