PT-2009-1764 · Niclor · Niclor Sito

Staker · Published 2009-02-26 · Updated 2017-09-29 · CVE-2008-6290

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: nicLOR Sito (affected versions not specified)

Description: The issue allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the page file parameter in includefile.php, particularly when register globals is enabled or magic quotes gpc is disabled.

Recommendations: For all affected versions, consider disabling the register globals setting and enabling magic quotes gpc to minimize the risk of exploitation. As a temporary workaround, restrict access to the includefile.php file to prevent remote attackers from including and executing arbitrary files. Avoid using the page file parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-6290

Affected Products

Niclor Sito

References · 5

• 🔥 https://exploit-db.com/exploits/6990 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6290 · Security Note
• http://secunia.com/advisories/32556 · Vendor Advisory
• http://securityfocus.com/bid/32111 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46338 · Note