PT-2008-3536 · Chilek · Chilek Content Management System

Hadi Kiamarsi · Published 2008-04-30 · Updated 2018-10-11 · CVE-2008-2016

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chilek Content Management System (aka ChiCoMaS) version 2.0.4

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter to the default URI under install/. This can also be leveraged to include and execute arbitrary local files via directory traversal sequences.

Recommendations For Chilek Content Management System (aka ChiCoMaS) version 2.0.4, consider restricting access to the install/ directory and validating the lang parameter to prevent directory traversal sequences until a patch is available. Avoid using the lang parameter in the affected API endpoint until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-2016

Affected Products

Chilek Content Management System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-2016 · Security Note
• http://securityreason.com/securityalert/3837 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42144 · Note
• http://securityfocus.com/archive/1/491369/100/0/threaded · Note