PT-2008-5129 · Softpress · Freeway
Published
2008-08-22
·
Updated
2018-10-11
·
CVE-2008-3770
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Freeway version 1.4.1.171
Description
The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the
language parameter to various PHP files, including (1) includes/events application top.php, (2) english/account.php, (3) french/account.php, (4) french/account newsletters.php in includes/languages/, (5) includes/modules/faqdesk/faqdesk article require.php, (6) includes/modules/newsdesk/newsdesk article require.php, (7) card1.php, (8) loginbox.php, and (9) whos online.php in templates/Freeway/boxes/, and (10) templates/Freeway/mainpage modules/mainpage.php. This can occur when register globals is enabled.Recommendations
For Freeway version 1.4.1.171, consider disabling the
register globals setting to prevent exploitation. Additionally, restrict access to the vulnerable PHP files, such as includes/events application top.php, english/account.php, french/account.php, french/account newsletters.php, includes/modules/faqdesk/faqdesk article require.php, includes/modules/newsdesk/newsdesk article require.php, card1.php, loginbox.php, whos online.php, and templates/Freeway/mainpage modules/mainpage.php, until a patch is available. Avoid using the language parameter in the affected API endpoints until the issue is resolved.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freeway