PT-2008-4415 · Homeph · Homeph Design

Cracker · Published 2008-07-02 · Updated 2017-09-29 · CVE-2008-2981

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HomePH Design version 2.10 RC2

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved by providing a URL in the thumb template parameter.

Recommendations For HomePH Design version 2.10 RC2, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the admin/templates/template thumbnail.php file until a patch is available. Avoid using the thumb template parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-2981

Affected Products

Homeph Design

References · 3

• 🔥 https://exploit-db.com/exploits/5903 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2981 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43256 · Note