PT-2007-4091 · Alstrasoft · Alstrasoft Template Seller Pro

Blackhawk · Published 2007-05-21 · Updated 2017-10-11 · CVE-2007-2777

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlstraSoft Template Seller Pro versions 3.25 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via an unrestricted file upload vulnerability. This is achieved by uploading an arbitrary .php filename in the zip parameter, which is then created under the sptemplates/ directory.

Recommendations For versions 3.25 and earlier, consider disabling the file upload functionality in admin/addsptemplate.php until a patch is available. Restrict access to the sptemplates/ directory to minimize the risk of exploitation. Avoid using the zip parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-2777

Affected Products

Alstrasoft Template Seller Pro

References · 5

• 🔥 https://exploit-db.com/exploits/3959 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2777 · Security Note
• http://osvdb.org/40423 · Note
• http://securityfocus.com/bid/24068 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34398 · Note