PT-2008-1631 · Myspace · Myspace Content Zone

Breaker_Unit + 1 · Published 2008-01-08 · Updated 2017-10-19 · CVE-2007-6668

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySpace Content Zone (MCZ) version 3.x

Description The issue concerns the admin/uploadgames.php file, which does not require administrative privileges. This allows remote attackers to perform unrestricted file uploads. Attackers can upload malicious files, such as .php files or files with names like .php%00.jpeg, to potentially execute arbitrary code.

Recommendations For MySpace Content Zone (MCZ) version 3.x, restrict access to the admin/uploadgames.php file to require administrative privileges, and validate all file uploads to prevent malicious files from being uploaded. As a temporary workaround, consider disabling the file upload functionality in admin/uploadgames.php until a proper fix is implemented.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-6668

Affected Products

Myspace Content Zone

References · 5

• 🔥 https://exploit-db.com/exploits/4741 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6668 · Security Note
• http://secunia.com/advisories/28159 · Vendor Advisory
• http://osvdb.org/40211 · Note
• http://securityfocus.com/bid/27062 · Note