PT-2009-1986 · Phpkf · Phpkf-Portal

Published 2009-03-25 · Updated 2017-08-17 · CVE-2008-6516

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpKF-Portal version 1.10

Description The issue allows remote attackers to include arbitrary files via directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the tema dizin parameter to "baslik.php" or the portal ayarlarportal dili parameter to "anket yonetim.php".

Recommendations For phpKF-Portal version 1.10, restrict access to the baslik.php and anket yonetim.php scripts to minimize the risk of exploitation. Avoid using the tema dizin and portal ayarlarportal dili parameters in the affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-6516

Affected Products

Phpkf-Portal

References · 5

• 🔥 http://securityfocus.com/bid/30566 · Exploit
• 🔥 https://exploit-db.com/exploits/32182 · Exploit
• 🔥 https://exploit-db.com/exploits/32183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6516 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44263 · Note