PT-2007-6281 · Xoops · Xoops

Phppp · Published 2007-10-03 · Updated 2011-03-08 · CVE-2007-5188

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xoops versions 2.0.17.1-RC1 and earlier

Description The issue is related to an unspecified vulnerability in the XOOPS uploader class, allowing remote attackers to upload arbitrary files. This is possibly due to improper upload configuration settings in class/uploader.php and class/mimetypes.inc.php, which may include an incomplete blacklist that omits the .php4 extension.

Recommendations For Xoops versions 2.0.17.1-RC1 and earlier, consider restricting access to the uploader class until a fix is available. As a temporary workaround, review and update the upload configuration settings in class/uploader.php and class/mimetypes.inc.php to ensure that all potentially executable file extensions, including .php4, are properly blacklisted.

Fix

Related Identifiers

CVE-2007-5188

Affected Products

Xoops

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-5188 · Security Note
• http://secunia.com/advisories/27006 · Vendor Advisory
• http://securityfocus.com/bid/25878 · Note
• http://osvdb.org/41386 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5188 · Note
• http://sourceforge.net/project/shownotes.php?group_id=41586&release_id=543338 · Note
• http://xoops.org/modules/news/article.php?storyid=3963 · Note
• http://vupen.com/english/advisories/2007/3315 · Note