PT-2008-2198 · Mindmeld · Mindmeld
David Wharton
·
Published
2008-02-05
·
Updated
2017-09-29
·
CVE-2008-0572
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Mindmeld version 1.2.0.10
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL in the
MM GLOBALS[home] parameter to several PHP files, including (1) acweb/admin index.php, (2) ask.inc.php, (3) learn.inc.php, (4) manage.inc.php, (5) mind.inc.php, and (6) sensory.inc.php in the include/ directory.Recommendations
For Mindmeld version 1.2.0.10, consider restricting access to the vulnerable PHP files until a patch is available. As a temporary workaround, avoid using the
MM GLOBALS[home] parameter in the affected API endpoints. Restrict access to the include/ directory to minimize the risk of exploitation.Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mindmeld