PT-2008-4569 · Neutrino · Neutrino Atomic Edition

Ams · Published 2008-07-11 · Updated 2017-09-29 · CVE-2008-3150

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Neutrino Atomic Edition version 0.8.4

Description: The issue allows remote attackers to read and modify files due to a directory traversal vulnerability in index.php. This can be exploited by manipulating data/sess.php in certain actions, such as 'usb' and 'del pag' actions. It is also possible to leverage this issue for code execution by performing an upload that bypasses access restrictions implemented in sess.php.

Recommendations: For Neutrino Atomic Edition version 0.8.4, consider restricting access to the vulnerable index.php file and the data/sess.php file until a patch is available. As a temporary workaround, avoid using the 'usb' and 'del pag' actions in index.php to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3150

Affected Products

Neutrino Atomic Edition

References · 5

• 🔥 https://exploit-db.com/exploits/6018 · Exploit
• http://secunia.com/advisories/30950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3150 · Security Note
• http://securityfocus.com/bid/30123 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43616 · Note