PT-2010-2152 · Bits · Bits Video Script

Published 2010-01-21 · Updated 2017-08-17 · CVE-2010-0366

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bits Video Script versions 2.04 through 2.05 Gold Beta

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to certain API endpoints, specifically through the files register.php and addvideo.php, and then accessing the uploaded file directly.

Recommendations For versions 2.04 through 2.05 Gold Beta, consider disabling the file upload functionality in register.php and addvideo.php until a patch is available to prevent remote code execution. Restrict access to the directories where uploaded files are stored to minimize the risk of exploitation. Avoid using executable file extensions for uploads in the affected API endpoints until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0366

Affected Products

Bits Video Script

References · 7

• 🔥 https://exploit-db.com/exploits/34120 · Exploit
• 🔥 http://packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/34119 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0366 · Security Note
• http://secunia.com/advisories/38252 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55738 · Note
• http://osvdb.org/61826 · Note