PT-2011-2326 · Phpgedview · Phpgedview

Dun · Published 2011-01-11 · Updated 2017-08-17 · CVE-2011-0405

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhpGedView version 4.2.3

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the module.php file when magic quotes gpc is disabled. This can be achieved by using directory traversal sequences in the pgvaction parameter.

Recommendations For PhpGedView version 4.2.3, consider disabling the module.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent directory traversal attacks. Avoid using the pgvaction parameter in the affected module until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-0405

Affected Products

Phpgedview

References · 10

• 🔥 http://exploit-db.com/exploits/15913 · Exploit
• 🔥 http://sourceforge.net/projects/phpgedview/forums/forum/185166/topic/4040059 · Exploit
• 🔥 https://exploit-db.com/exploits/15913 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0405 · Security Note
• http://vupen.com/english/advisories/2011/0036 · Vendor Advisory
• http://sourceforge.net/tracker/?func=detail&aid=3152857&group_id=55456&atid=477081 · Patch
• http://secunia.com/advisories/42786 · Vendor Advisory
• http://osvdb.org/70295 · Note
• http://securityfocus.com/bid/45674 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64733 · Note