PT-2008-6840 · Joomla · Com Competitions

Noge · Published 2008-12-31 · Updated 2017-09-29 · CVE-2008-5790

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions com competitions version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. This can be achieved by manipulating the GLOBALS[mosConfig absolute path] parameter in add.php and competitions.php files located in the includes/competitions/ directory, and the mosConfig absolute path parameter in the settings.php file within the includes/settings/ directory.

Recommendations For com competitions version 1.0, consider restricting access to the add.php, competitions.php, and settings.php files until a patch is available. As a temporary workaround, avoid using the GLOBALS[mosConfig absolute path] and mosConfig absolute path parameters in the affected API endpoints.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-5790

Affected Products

Com Competitions

References · 3

• 🔥 https://exploit-db.com/exploits/7039 · Exploit
• 🔥 http://securityfocus.com/bid/32192 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5790 · Security Note