PT-2007-6784 · Axdcms · Ax Developer Cms

Gold_M · Published 2007-11-05 · Updated 2017-09-29 · CVE-2007-5820

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ax Developer CMS (AxDCMS) version 0.1.1

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter. This can be exploited by sending a malicious request to the /index.php endpoint.

Recommendations For Ax Developer CMS (AxDCMS) version 0.1.1, consider restricting access to the module parameter in the index.php file to minimize the risk of exploitation. Avoid using the module parameter with untrusted input until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5820

Affected Products

Ax Developer Cms

References · 6

• 🔥 https://exploit-db.com/exploits/4599 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5820 · Security Note
• http://osvdb.org/39021 · Note
• http://securityfocus.com/bid/26306 · Note
• http://vupen.com/english/advisories/2007/3749 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38224 · Note