PT-2010-1442 · Unknown · Advanced Comment System

Published 2010-01-18 · Updated 2021-02-08 · CVE-2009-4623

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Advanced Comment System version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the ACS path parameter to API endpoints such as "index.php" and "admin.php" in the advanced comment system/ directory. This might only be a vulnerability when the administrator has not followed installation instructions in install.php.

Recommendations For Advanced Comment System version 1.0, ensure that the administrator follows the installation instructions in install.php to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the ACS path parameter in the affected API endpoints until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-4623

Affected Products

Advanced Comment System

References · 5

• 🔥 http://exploit-db.com/exploits/9623 · Exploit
• 🔥 https://exploit-db.com/exploits/9623 · Exploit
• http://secunia.com/advisories/36643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4623 · Security Note
• https://t.me/cvenotify/9571 · Telegram Post