PT-2007-6847 · Jbc · Jbc Explorer

Darkfig · Published 2007-11-10 · Updated 2018-10-15 · CVE-2007-5914

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBC Explorer versions 7.20 RC1 and earlier

Description A direct static code injection issue exists, allowing remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter. This code can be executed by accessing config.inc.php. It's also possible for unauthenticated remote attackers to exploit this issue.

Recommendations For JBC Explorer versions 7.20 RC1 and earlier, consider disabling access to the config/post.php module until a fix is available. As a temporary workaround, restrict the use of the DEBUG parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5914

Affected Products

Jbc Explorer

References · 7

• 🔥 https://exploit-db.com/exploits/4608 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5914 · Security Note
• http://secunia.com/advisories/27533 · Vendor Advisory
• http://securityfocus.com/archive/1/483268/100/0/threaded · Note
• http://securityreason.com/securityalert/3358 · Note
• http://mgsdl.free.fr/?1:33 · Note
• http://osvdb.org/42070 · Note