PT-2009-1983 · Aphpkb · Andy'S Php Knowledgebase

Cwh Underground · Published 2009-03-24 · Updated 2017-09-29 · CVE-2008-6513

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Andy's PHP Knowledgebase (aphpkb) version 0.92.9

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to saa.php, then accessing it via a link listed by authors.php.

Recommendations For version 0.92.9, consider restricting or disabling file uploads in saa.php to prevent exploitation until a fix is available. As a temporary workaround, restrict access to authors.php to minimize the risk of linking to maliciously uploaded files. Avoid using executable file extensions in uploads to saa.php until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-6513

Affected Products

Andy'S Php Knowledgebase

References · 6

• 🔥 https://exploit-db.com/exploits/7312 · Exploit
• http://sourceforge.net/project/shownotes.php?group_id=113755&release_id=667918 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-6513 · Security Note
• http://secunia.com/advisories/34476 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46977 · Note
• http://securityfocus.com/bid/32559 · Note