PT-2010-2780 · Phpkobo · Phpkobo Address Book Script

Published 2010-03-23 · Updated 2010-03-24 · CVE-2010-1059

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phpkobo Address Book Script version 1.09

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANG CODE parameter when magic quotes gpc is disabled.

Recommendations For Phpkobo Address Book Script version 1.09, consider disabling the LANG CODE parameter or restricting its use until a patch is available to prevent directory traversal attacks. Additionally, enabling magic quotes gpc may help mitigate this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-1059

Affected Products

Phpkobo Address Book Script

References · 4

• 🔥 http://securityfocus.com/bid/38731 · Exploit
• http://secunia.com/advisories/38938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1059 · Security Note
• http://osvdb.org/63004 · Note