PT-2008-6715 · Kusaba · Kusaba

Sausage · Published 2008-12-18 · Updated 2017-09-29 · CVE-2008-5663

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kusaba versions 1.0.4 and earlier

Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load receiver.php or (2) a shipainter action to paint save.php, then accessing the uploaded file via a direct request to this file in their user directory.

Recommendations For Kusaba versions 1.0.4 and earlier, consider restricting access to load receiver.php and paint save.php to prevent unauthorized file uploads until a fix is available. As a temporary workaround, restrict the shipainter action to minimize the risk of exploitation. Avoid allowing users to upload files with executable extensions.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-5663

Affected Products

Kusaba

References · 8

• 🔥 https://exploit-db.com/exploits/6711 · Exploit
• 🔥 https://exploit-db.com/exploits/6706 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5663 · Security Note
• http://securityfocus.com/bid/31685 · Vendor Advisory
• http://securityfocus.com/bid/31668 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45794 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45793 · Note
• http://securityreason.com/securityalert/4782 · Note