PT-2009-1395 · Websvn · Websvn

James Bercegay · Published 2009-01-21 · Updated 2017-09-29 · CVE-2008-5920

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSVN versions 1.x

Description The issue allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg replace function with the eval switch. This is due to a problem in the create anchors function in utils.inc.

Recommendations For WebSVN version 1.x, consider disabling the create anchors function in utils.inc until a patch is available to prevent the execution of arbitrary PHP code. Restrict access to the preg replace function with the eval switch to minimize the risk of exploitation. Avoid using the username variable in the affected function until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-5920

Affected Products

Websvn

References · 7

• 🔥 https://exploit-db.com/exploits/6822 · Exploit
• 🔥 http://securityfocus.com/bid/31891 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5920 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5920 · Note
• http://securityreason.com/securityalert/4928 · Note
• http://gulftech.org/?node=research&article_id=00132-10202008 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48168 · Note