PT-2008-3033 · W Agora · W-Agora

Published 2008-03-24 · Updated 2017-08-08 · CVE-2008-1466

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions W-Agora version 4.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the bn dir default parameter to various PHP files, including "add user.php", "create forum.php", "create user.php", "delete notes.php", "delete user.php", "edit forum.php", "mail users.php", "moderate notes.php", and "reorder forums.php".

Recommendations For W-Agora version 4.0, consider restricting access to the bn dir default parameter in the affected PHP files until a patch is available. As a temporary workaround, avoid using the bn dir default parameter in the specified API endpoints.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-1466

Affected Products

W-Agora

References · 13

• 🔥 https://exploit-db.com/exploits/31453 · Exploit
• 🔥 https://exploit-db.com/exploits/31452 · Exploit
• 🔥 https://exploit-db.com/exploits/31457 · Exploit
• 🔥 https://exploit-db.com/exploits/31449 · Exploit
• 🔥 http://securityfocus.com/bid/28366 · Exploit
• 🔥 https://exploit-db.com/exploits/31450 · Exploit
• 🔥 https://exploit-db.com/exploits/31456 · Exploit
• 🔥 https://exploit-db.com/exploits/31455 · Exploit
• 🔥 https://exploit-db.com/exploits/31454 · Exploit
• 🔥 https://exploit-db.com/exploits/31451 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1466 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41352 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1466 · Note