PT-2009-6443 · Eocms · Eocms

1Nd0N3S14N L4M3R · Published 2009-12-14 · Updated 2009-12-15 · CVE-2009-4319

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eoCMS versions 0.9.03 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved via a URL in the BBCODE path parameter.

Recommendations For versions 0.9.03 and earlier, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the bbcode-form.php file in the js/bbcodepress directory until a patch is available. Avoid using the BBCODE path parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-4319

Affected Products

Eocms

References · 4

• 🔥 http://exploit-db.com/exploits/10422 · Exploit
• 🔥 https://exploit-db.com/exploits/10422 · Exploit
• http://secunia.com/advisories/37749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4319 · Security Note