PT-2008-2421 · Lookstrike · Lookstrike Lan Manager

Mhz91 · Published 2008-02-15 · Updated 2017-09-29 · CVE-2008-0803

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LookStrike Lan Manager version 0.9

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the sys conf[path][real] parameter to various PHP files. This can be leveraged to include and execute arbitrary local files via directory traversal sequences. The affected files include multiple PHP scripts in the modulesclass and modulesclassdb directories, as well as modulesclasstournament.

Recommendations For LookStrike Lan Manager version 0.9, consider restricting access to the sys conf[path][real] parameter to prevent remote file inclusion attacks. As a temporary workaround, restrict access to the affected PHP files in the modulesclass, modulesclassdb, and modulesclasstournament directories until a patch is available. Avoid using the sys conf[path][real] parameter in URLs to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-0803

Affected Products

Lookstrike Lan Manager

References · 3

• 🔥 https://exploit-db.com/exploits/5121 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0803 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40519 · Note