PT-2007-6156 · Unknown · Izicontents
Irk4Z
·
Published
2007-09-24
·
Updated
2017-09-29
·
CVE-2007-5053
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
iziContents versions 1 RC6 and earlier
Description
The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. This is due to incomplete blacklist vulnerabilities, which are related to missing checks for the inclusion of certain URLs. The affected parameters include
admin home in modules/poll/poll summary.php, rootdp in include/db.php, and language home in several other files, such as search/search.php, poll/inlinepoll.php, poll/showpoll.php, links/showlinks.php, and links/submit links.php. An example of exploitation is using an ftps:// URL.Recommendations
For iziContents versions 1 RC6 and earlier, consider disabling the affected parameters, such as
admin home, rootdp, and language home, until a patch is available. Restrict access to the vulnerable modules, including modules/poll/poll summary.php, include/db.php, search/search.php, poll/inlinepoll.php, poll/showpoll.php, links/showlinks.php, and links/submit links.php, to minimize the risk of exploitation. Avoid using URLs that could be used to exploit the missing checks in modules/moduleSec.php and include/includeSec.php. At the moment, there is no information about a newer version that contains a fix for this issue.Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Izicontents