PT-2007-6911 · Justin Hagstrom · Autoindex Php Script

Published 2007-11-15 · Updated 2018-10-15 · CVE-2007-5984

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Justin Hagstrom AutoIndex PHP Script versions prior to 2.2.4

Description The issue allows remote attackers to cause a denial of service, consuming CPU and memory, by sending a %00 sequence in the dir parameter to "index.php", triggering an erroneous recursive calculation.

Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" endpoint to minimize the risk of exploitation. Avoid using the dir parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-5984

Affected Products

Autoindex Php Script

References · 9

• 🔥 https://exploit-db.com/exploits/30753 · Exploit
• http://autoindex.sourceforge.net/change_log.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-5984 · Security Note
• http://securityfocus.com/bid/26410 · Note
• http://securityfocus.com/archive/1/483592/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38437 · Note
• http://securityreason.com/securityalert/3360 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5984 · Note
• http://osvdb.org/45282 · Note