PT-2008-6072 · Tribiq · Tribiq Cms

Gold_M · Published 2008-11-04 · Updated 2017-10-19 · CVE-2008-4894

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tribiq CMS versions 5.0.10a through 5.0.12c

Description A directory traversal issue exists in the header.inc.php file, allowing remote attackers to include and execute arbitrary local files. This occurs when register globals is enabled and magic quotes gpc is disabled. The issue is exploited through directory traversal sequences in the template path parameter.

Recommendations For Tribiq CMS versions 5.0.10a through 5.0.12c, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the template path parameter in the affected header.inc.php file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-4894

Affected Products

Tribiq Cms

References · 6

• 🔥 https://exploit-db.com/exploits/6888 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4894 · Security Note
• http://secunia.com/advisories/32548 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4894 · Note
• http://securityfocus.com/bid/32018 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46264 · Note