PT-2009-1441 · Globsy · Globsy

Staker · Published 2009-01-26 · Updated 2017-09-29 · CVE-2008-5966

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Globsy versions 1.0 and earlier

Description The issue allows remote attackers to create or overwrite arbitrary files. This is achieved by specifying a filename in the file parameter and providing file contents in the data parameter in the globsy edit.php file.

Recommendations For Globsy versions 1.0 and earlier, consider restricting access to the globsy edit.php file until a fix is available, and avoid using the file and data parameters in this file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-5966

Affected Products

Globsy

References · 4

• 🔥 http://securityfocus.com/bid/31727 · Exploit
• 🔥 https://exploit-db.com/exploits/6735 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5966 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48324 · Note