PT-2007-7269 · Bitweaver · Bitweaver

Doz · Published 2007-12-17 · Updated 2018-10-15 · CVE-2007-6412

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bitweaver versions 2.0.0 and earlier

Description A direct static code injection issue exists when comments are enabled, allowing remote attackers to inject arbitrary PHP code via an editcomments action.

Recommendations For Bitweaver versions 2.0.0 and earlier, consider disabling the comments feature to prevent exploitation until a fix is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-6412

Affected Products

Bitweaver

References · 8

• 🔥 http://hackerscenter.com/archive/view.asp?id=28129 · Exploit
• 🔥 http://securityfocus.com/bid/26801 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6412 · Security Note
• http://osvdb.org/40148 · Note
• http://securityreason.com/securityalert/3428 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6412 · Note
• http://securityreason.com/securityalert/3454 · Note
• http://securityfocus.com/archive/1/484805/100/0/threaded · Note