PT-2008-4182 · Apache+1 · Apache+1

Egix · Published 2008-06-17 · Updated 2017-09-29 · CVE-2008-2742

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Achievo versions 1.2.0 through 1.3.2

Description The issue allows remote attackers to execute arbitrary code by uploading a file with a .php extension followed by a safe extension to the mcpuk file editor, and then accessing it via a direct request to the file in the Achievo root directory. This is only a problem in environments that support multiple extensions, such as Apache with the mod mime module enabled.

Recommendations For Achievo versions 1.2.0 through 1.3.2, consider restricting access to the mcpuk file editor to prevent unauthorized file uploads until a patch is available. As a temporary workaround, restrict the execution of files with multiple extensions in the Achievo root directory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2742

Affected Products

Achievo

Apache

References · 6

• 🔥 https://exploit-db.com/exploits/5770 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2742 · Security Note
• http://secunia.com/advisories/30597 · Vendor Advisory
• http://securityfocus.com/bid/29621 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42980 · Note
• http://achievo.org/blog/archives/631-Achievo-1.3.3-Security-Release.html · Note