PT-2009-1477 · Web-Cp · Web-Cp

Gold_M · Published 2009-01-28 · Updated 2017-09-29 · CVE-2008-6002

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions web-cp version 0.5.7

Description The issue allows remote attackers to read arbitrary files due to an absolute path traversal vulnerability in sendfile.php when register globals is enabled. This is achieved by providing a full pathname in the filelocation parameter.

Recommendations For web-cp version 0.5.7, consider disabling the sendfile.php script or restricting access to it until a patch is available. Additionally, disabling register globals can help mitigate the risk of exploitation. Avoid using the filelocation parameter in the affected script until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-6002

Affected Products

Web-Cp

References · 6

• 🔥 http://securityfocus.com/bid/31371 · Exploit
• 🔥 https://exploit-db.com/exploits/6556 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6002 · Security Note
• http://secunia.com/advisories/31979 · Vendor Advisory
• http://web-cp.net/mantis/changelog_page.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45408 · Note