PT-2007-6062 · Webmedia · Webmedia Explorer

Published 2007-09-18 · Updated 2008-11-15 · CVE-2007-4948

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webmedia Explorer version 3.2.2

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via several parameters, including path include to includes/rss.class.php, path template to templates/main.tpl.php or templates/folder messages link message name.tpl.php, and path templates to templates/sidebar.tpl.php. The vulnerability is only present if the administrator fails to follow installation instructions regarding .htaccess support.

Recommendations For Webmedia Explorer version 3.2.2, ensure that the administrator follows the installation instructions about the requirement for .htaccess support to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the vulnerable parameters path include, path template, and path templates until the issue is resolved.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-4948

Affected Products

Webmedia Explorer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-4948 · Security Note
• http://arfis.wordpress.com/2007/09/14/rfi-03-webmedia-explorer · Note
• http://osvdb.org/43141 · Note
• http://osvdb.org/43140 · Note
• http://osvdb.org/43143 · Note
• http://osvdb.org/43142 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4948 · Note