PT-2010-2783 · Phpkobo · Phpkobo Free Real Estate Contact Form

Pouya Daneshmand · Published 2010-03-23 · Updated 2010-03-24 · CVE-2010-1062

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phpkobo Free Real Estate Contact Form version 1.09

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG CODE parameter when magic quotes gpc is disabled.

Recommendations For Phpkobo Free Real Estate Contact Form version 1.09, consider disabling the LANG CODE parameter or restricting its use until a patch is available. Additionally, enabling magic quotes gpc may help mitigate the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-1062

Affected Products

Phpkobo Free Real Estate Contact Form

References · 6

• 🔥 http://securityfocus.com/bid/38731 · Exploit
• 🔥 http://exploit-db.com/exploits/11773 · Exploit
• 🔥 https://exploit-db.com/exploits/11773 · Exploit
• 🔥 http://packetstormsecurity.org/1003-exploits/frecf-lfi.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1062 · Security Note
• http://secunia.com/advisories/38967 · Vendor Advisory