PT-2009-5669 · Sznews · Sznews

Published 2009-09-24 · Updated 2009-09-25 · CVE-2009-3362

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SZNews version 2.7

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the id parameter in the printnews.php3 file.

Recommendations For SZNews version 2.7, consider restricting access to the printnews.php3 file or validating and sanitizing the id parameter to prevent remote file inclusion attacks. As a temporary workaround, avoid using the id parameter in the printnews.php3 file until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3362

Affected Products

Sznews

References · 5

• 🔥 http://packetstormsecurity.org/0909-exploits/sznews-rfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/34598 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3362 · Security Note
• http://secunia.com/advisories/36699 · Vendor Advisory
• http://osvdb.org/57986 · Note