PT-2008-3093 · Powerphp · Powerphpboard

Published 2008-03-28 · Updated 2018-10-11 · CVE-2008-1534

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PowerPHPBoard version 1.00b

Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the settings[footer] parameter to "footer.inc.php" and the settings[header] parameter to "header.inc.php".

Recommendations For PowerPHPBoard version 1.00b, consider restricting access to the vulnerable parameters settings[footer] and settings[header] to minimize the risk of exploitation. Avoid using the .. (dot dot) sequence in these parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-1534

Affected Products

Powerphpboard

References · 7

• 🔥 https://exploit-db.com/exploits/5303 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1534 · Security Note
• http://securityreason.com/securityalert/3782 · Note
• http://securityfocus.com/archive/1/490011/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41403 · Note
• http://vupen.com/english/advisories/2008/0992/references · Note
• http://securityfocus.com/bid/28421 · Note