PT-2008-6843 · Joomla · Clickheat

Noge · Published 2008-12-31 · Updated 2017-09-29 · CVE-2008-5793

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Clickheat - Heatmap stats (com clickheat) component version 1.0.1 for Joomla!

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. This is achieved by providing a URL in the GLOBALS[mosConfig absolute path] parameter to files such as install.clickheat.php, Cache.php, Clickheat Heatmap.php, and GlobalVariables.php, and the mosConfig absolute path parameter to files like main.php, main.php, and main.php in the includes/overview directory.

Recommendations For Clickheat - Heatmap stats (com clickheat) component version 1.0.1, consider disabling the install.clickheat.php, Cache.php, Clickheat Heatmap.php, GlobalVariables.php, main.php, and main.php files until a patch is available to prevent remote attackers from executing arbitrary PHP code. Restrict access to the includes/heatmap and includes/overview directories to minimize the risk of exploitation. Avoid using the mosConfig absolute path and GLOBALS[mosConfig absolute path] parameters in the affected files until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-5793

Affected Products

Clickheat

References · 5

• 🔥 http://securityfocus.com/bid/32190 · Exploit
• 🔥 https://exploit-db.com/exploits/7038 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5793 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46439 · Note
• http://securityreason.com/securityalert/4841 · Note