PT-2010-3048 · Nodesforum · Nodesforum

Published 2010-04-12 · Updated 2017-08-17 · CVE-2010-1351

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nodesforum versions 1.033 through 1.045

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This can be achieved via a URL in the nodesforum path from here to nodesforum folder parameter to erase user data.php and the nodesforum code path parameter to pre output.php.

Recommendations For versions 1.033 through 1.045, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the erase user data.php and pre output.php scripts until a fix is available. Avoid using the nodesforum path from here to nodesforum folder and nodesforum code path parameters in these scripts until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-1351

Affected Products

Nodesforum

References · 5

• 🔥 https://exploit-db.com/exploits/12047 · Exploit
• 🔥 http://exploit-db.com/exploits/12047 · Exploit
• http://secunia.com/advisories/39311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1351 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57517 · Note