PT-2007-6271 · Mxbb · Mxbb

Bd0Rk · Published 2007-10-03 · Updated 2017-09-29 · CVE-2007-5178

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mxBB module mx glance version 2.3.3

Description The issue allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mx root path parameter. This is due to a critical security check being placed within a comment because of a missing comment delimiter in the contrib/mx glance sdesc.php file.

Recommendations For mxBB module mx glance version 2.3.3, consider restricting access to the mx root path parameter to minimize the risk of exploitation. Additionally, ensure proper comment delimiters are used in the contrib/mx glance sdesc.php file to prevent security checks from being ignored. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5178

Affected Products

Mxbb

References · 9

• 🔥 http://attrition.org/pipermail/vim/2007-October/001807.html · Exploit
• 🔥 https://exploit-db.com/exploits/4470 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5178 · Security Note
• http://osvdb.org/37400 · Note
• http://secunia.com/advisories/27011 · Note
• http://attrition.org/pipermail/vim/2007-October/001808.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36867 · Note
• http://vupen.com/english/advisories/2007/3326 · Note
• http://securityfocus.com/bid/25866 · Note