PT-2009-3309 · Ravennuke · Ravennuke

Janek Vind + 1 · Published 2009-02-22 · Updated 2018-10-10 · CVE-2009-0674

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RavenNuke version 2.30

Description The issue allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter and observing the error messages. This is possible when register globals and display errors are enabled. The error messages differ between existing and nonexistent pathnames, enabling attackers to gather information about the local file system.

Recommendations For RavenNuke version 2.30, disable register globals and display errors to prevent exploitation. As a temporary workaround, consider restricting access to the images/captcha.php file until a patch is available. Avoid using the aFonts array parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0674

Affected Products

Ravennuke

References · 8

• 🔥 http://waraxe.us/advisory-72.html · Exploit
• 🔥 https://exploit-db.com/exploits/8068 · Exploit
• http://ravenphpscripts.com/postt17156.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0674 · Security Note
• http://securityfocus.com/archive/1/500988/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48792 · Note
• http://securityfocus.com/bid/33787 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48983 · Note