PT-2008-5717 · Crux · Crux Gallery

Pepelux · Published 2008-10-08 · Updated 2018-10-11 · CVE-2008-4484

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Crux Gallery versions 1.32 and earlier

Description: The issue allows remote attackers to gain administrative access. This can be achieved by setting the name parameter to "users" in the main.php file, as demonstrated via the index.php endpoint.

Recommendations: For Crux Gallery versions 1.32 and earlier, avoid using the name parameter in the main.php file until the issue is resolved. As a temporary workaround, consider restricting access to the main.php file to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-4484

Affected Products

Crux Gallery

References · 8

• 🔥 https://exploit-db.com/exploits/6586 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4484 · Security Note
• http://secunia.com/advisories/32058 · Vendor Advisory
• http://securityreason.com/securityalert/4365 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45443 · Note
• http://attrition.org/pipermail/vim/2008-October/002083.html · Note
• http://securityfocus.com/archive/1/496763/100/0/threaded · Note
• http://securityfocus.com/bid/31430 · Note