PT-2008-4422 · Benja · Benja Cms

Cwh · Published 2008-07-02 · Updated 2018-10-11 · CVE-2008-2988

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Benja CMS version 0.1

Description The issue concerns an unrestricted file upload vulnerability. This allows remote attackers to upload and execute arbitrary PHP files. The attack is carried out via unspecified vectors, followed by a direct request to the file in the billeder/ directory.

Recommendations For Benja CMS version 0.1, restrict access to the admin/upload.php file to prevent unauthorized file uploads. As a temporary workaround, consider disabling the file upload functionality in admin/upload.php until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2988

Affected Products

Benja Cms

References · 6

• 🔥 http://securityfocus.com/bid/29884 · Exploit
• http://secunia.com/advisories/30834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2988 · Security Note
• http://securityreason.com/securityalert/3958 · Note
• http://securityfocus.com/archive/1/493568/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43282 · Note