PT-2009-6592 · Freeschool · Freeschool

Cr4Wl3R · Published 2009-12-30 · Updated 2017-09-19 · CVE-2009-4471

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeSchool versions 1.1.0 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the CLASSPATH parameter to various PHP files, including (1) bib form.php, (2) bib pldetails.php, (3) bib plform.php, (4) bib plsearchc.php, (5) bib plsearchs.php, (6) bib save.php, (7) bib searchc.php, (8) bib searchs.php, (9) edi form.php, (10) edi save.php, (11) gen form.php, (12) gen save.php, (13) lin form.php, (14) lin save.php, (15) luo form.php, (16) luo save.php, (17) sog form.php, or (18) sog save.php in the biblioteca/ directory; (19) cal insert.php, (20) cal save.php, or (21) cal saveactivity.php in the calendario/ directory; (22) circolari/cir save.php; or (23) modulistica/mdl save.php.

Recommendations For FreeSchool versions 1.1.0 and earlier, consider disabling the CLASSPATH parameter in the affected PHP files until a patch is available. Restrict access to the vulnerable PHP files to minimize the risk of exploitation. Avoid using the CLASSPATH parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-4471

Affected Products

Freeschool

References · 6

• 🔥 http://exploit-db.com/exploits/9582 · Exploit
• 🔥 https://exploit-db.com/exploits/9582 · Exploit
• http://vupen.com/english/advisories/2009/2535 · Vendor Advisory
• http://secunia.com/advisories/36605 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4471 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53017 · Note