PT-2010-2973 · Justvisual · Justvisual Cms

Eidelweiss · Published 2010-04-06 · Updated 2017-08-17 · CVE-2010-1268

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions justVisual CMS version 2.0

Description A directory traversal issue exists in index.php, allowing remote attackers to include and execute arbitrary local files when magic quotes gpc is disabled. This is achieved by using directory traversal sequences in the p parameter.

Recommendations For justVisual CMS version 2.0, consider disabling the use of the p parameter in index.php or enabling magic quotes gpc to minimize the risk of exploitation. Additionally, restrict access to sensitive files and directories to prevent unauthorized inclusion and execution.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-1268

Affected Products

Justvisual Cms

References · 8

• 🔥 http://exploit-db.com/exploits/11876 · Exploit
• 🔥 http://packetstormsecurity.org/1003-exploits/justvisual-lfi.txt · Exploit
• 🔥 http://securityfocus.com/bid/38970 · Exploit
• 🔥 https://exploit-db.com/exploits/11876 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1268 · Security Note
• http://secunia.com/advisories/39093 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57174 · Note
• http://osvdb.org/63156 · Note