PT-2008-5950 · Plugspace · Plugspace

Dun · Published 2008-10-24 · Updated 2017-09-29 · CVE-2008-4739

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PlugSpace version 0.1

Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability in the index.php file when the magic quotes gpc setting is disabled. The vulnerability can be triggered by including a .. (dot dot) in the navi parameter of a specific API endpoint, although the exact endpoint is not specified.

Recommendations For PlugSpace version 0.1, consider disabling the execution of arbitrary local files or restricting access to the navi parameter until a patch is available. Additionally, enabling magic quotes gpc may help mitigate this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-4739

Affected Products

Plugspace

References · 5

• 🔥 https://exploit-db.com/exploits/6602 · Exploit
• 🔥 http://secunia.com/advisories/32033 · Exploit
• 🔥 http://securityfocus.com/bid/31457 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4739 · Security Note
• http://securityreason.com/securityalert/4475 · Note