PT-2008-6397 · Tnt · Ttforum

Cwh Underground · Published 2008-11-28 · Updated 2017-09-29 · CVE-2008-5265

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TNT Forum version 0.9.4

Description A directory traversal issue exists in index.php, allowing remote attackers to include and execute arbitrary local files when magic quotes gpc is disabled. This is achieved through directory traversal sequences in the modulo parameter.

Recommendations For TNT Forum version 0.9.4, consider disabling the execution of arbitrary local files or restricting access to the modulo parameter in the index.php file until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5265

Affected Products

Ttforum

References · 6

• 🔥 https://exploit-db.com/exploits/5782 · Exploit
• 🔥 http://securityfocus.com/bid/29645 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5265 · Security Note
• http://secunia.com/advisories/30595 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42978 · Note
• http://securityreason.com/securityalert/4656 · Note