PT-2009-3170 · Php · Phpslash

Darkfig · Published 2009-02-11 · Updated 2018-10-11 · CVE-2009-0517

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions phpSlash versions 0.8.1.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval() function call within the generic function in include/class/tz env.class.

Recommendations For phpSlash versions 0.8.1.1 and earlier, consider disabling the eval() function call within the generic function in include/class/tz env.class as a temporary workaround until a patch is available. Restrict access to the fields parameter in the affected API endpoint to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0517

Affected Products

Phpslash

References · 7

• 🔥 http://securityfocus.com/bid/33572 · Exploit
• 🔥 https://exploit-db.com/exploits/7948 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0517 · Security Note
• http://secunia.com/advisories/33717 · Vendor Advisory
• http://securityfocus.com/archive/1/500664/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48441 · Note
• http://osvdb.org/51727 · Note