PT-2009-2427 · Crossday · Discuz! Board

80Vul · Published 2009-08-12 · Updated 2017-09-29 · CVE-2008-6958

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Crossday Discuz! Board versions 6.x through 7.x

Description: The issue allows remote authenticated users to execute arbitrary PHP code. This is achieved via the creditsformula parameter in the "wap/index.php" endpoint.

Recommendations: For Crossday Discuz! Board versions 6.x through 7.x, avoid using the creditsformula parameter in the "wap/index.php" endpoint until a fix is available. As a temporary workaround, consider restricting access to the "wap/index.php" endpoint to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-6958

Affected Products

Discuz! Board

References · 8

• 🔥 http://securityfocus.com/bid/32303 · Exploit
• 🔥 http://80vul.com/dzvul/sodb/13/dz-exp-sodb-2008-13_php.htm · Exploit
• 🔥 https://exploit-db.com/exploits/7119 · Exploit
• 🔥 http://discuz.net/archiver/?tid-1112426.html · Exploit
• http://secunia.com/advisories/32731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6958 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46644 · Note
• http://osvdb.org/50202 · Note