PT-2007-6826 · Idmos · Idmos

Published 2007-11-08 · Updated 2018-10-15 · CVE-2007-5889

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IDMOS version 1.0 Alpha

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the site absolute path parameter to specific API endpoints, including "admin.php", "menu add.php", and "menu operation.php" in the administrator directory.

Recommendations For IDMOS version 1.0 Alpha, consider restricting access to the admin.php, menu add.php, and menu operation.php files in the administrator directory to minimize the risk of exploitation. Avoid using the site absolute path parameter in these API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-5889

Affected Products

Idmos

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-5889 · Security Note
• http://osvdb.org/38736 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38294 · Note
• http://osvdb.org/38735 · Note
• http://securityfocus.com/archive/1/483351/100/0/threaded · Note
• http://securityreason.com/securityalert/3345 · Note
• http://osvdb.org/38737 · Note