PT-2009-1355 · Phpclanwebsite · Phpclanwebsite

S4Avrd0W · Published 2009-01-08 · Updated 2017-09-29 · CVE-2008-5878

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phpclanwebsite versions 1.23.3 Fix Pack 5 and earlier

Description The issue allows remote attackers to include and execute arbitrary files via directory traversal vulnerabilities. This is possible when magic quotes gpc is disabled and register globals is enabled. The vulnerabilities can be exploited through the boxname parameter to "theme/superchrome/box.php" and the theme parameter to "phpclanwebsite/footer.php".

Recommendations For Phpclanwebsite versions 1.23.3 Fix Pack 5 and earlier, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the box.php and footer.php files until a patch is available. Avoid using the boxname and theme parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5878

Affected Products

Phpclanwebsite

References · 5

• 🔥 https://exploit-db.com/exploits/7515 · Exploit
• 🔥 http://securityfocus.com/bid/32915 · Exploit
• http://secunia.com/advisories/33211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5878 · Security Note
• http://securityreason.com/securityalert/4881 · Note