PT-2007-4076 · Bif3 · Build It Fast

Alkomandoz Hacker · Published 2007-05-18 · Updated 2017-10-11 · CVE-2007-2762

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Build it Fast (bif3) version 0.4.1

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the pear dir parameter to Base/Application.php, or the sys dir parameter to various PHP files in the Widgets/Base/ directory, including Footer.php, widget.BifContainer.php, widget.BifRoot.php, widget.BifRoot2.php, widget.BifRoot3.php, and widget.BifWarning.php.

Recommendations For Build it Fast (bif3) version 0.4.1, consider restricting access to the pear dir and sys dir parameters in the affected PHP files until a patch is available. As a temporary workaround, avoid using the pear dir parameter in the Base/Application.php file and the sys dir parameter in the Footer.php, widget.BifContainer.php, widget.BifRoot.php, widget.BifRoot2.php, widget.BifRoot3.php, and widget.BifWarning.php files in the Widgets/Base/ directory.

Exploit

Fix

Related Identifiers

CVE-2007-2762

Affected Products

Build It Fast

References · 11

• 🔥 https://exploit-db.com/exploits/3947 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2762 · Security Note
• http://osvdb.org/37954 · Note
• http://osvdb.org/37950 · Note
• http://osvdb.org/37953 · Note
• http://securityfocus.com/bid/24045 · Note
• http://osvdb.org/37951 · Note
• http://osvdb.org/37955 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34362 · Note
• http://osvdb.org/37949 · Note
• http://osvdb.org/37952 · Note