PT-2008-6346 · Poweraward · Poweraward

Cracker · Published 2008-11-21 · Updated 2017-09-29 · CVE-2008-5204

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PowerAward version 1.1.0 RC1

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences. This is possible when the register globals setting is enabled. The vulnerability can be exploited through various API endpoints, including /agb.php, /angemeldet.php, /anmelden.php, /charts.php, /external vote.php, /guestbook.php, /impressum.php, /index.php, /rss-reader.php, /statistic.php, /teilnehmer.php, /topsites.php, /votecode.php, /voting.php, and /winner.php, by manipulating the lang parameter.

Recommendations For PowerAward version 1.1.0 RC1, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the vulnerable API endpoints until a patch is available. Avoid using the lang parameter in the affected endpoints until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5204

Affected Products

Poweraward

References · 4

• 🔥 https://exploit-db.com/exploits/5962 · Exploit
• 🔥 http://securityfocus.com/bid/29993 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5204 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43463 · Note