PT-2011-2404 · Zwii · Zwii

Abdi Mohamed · Published 2011-01-20 · Updated 2017-08-17 · CVE-2011-0505

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zwii version 2.1.1

Description A directory traversal issue exists when magic quotes gpc is disabled and register globals is enabled, allowing remote attackers to include and execute arbitrary local files via directory traversal sequences in the set[template][value] parameter.

Recommendations For Zwii version 2.1.1, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the system/system.php file to minimize the risk of arbitrary file inclusion. Avoid using the set[template][value] parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-0505

Affected Products

Zwii

References · 8

• 🔥 https://exploit-db.com/exploits/15945 · Exploit
• 🔥 http://exploit-db.com/exploits/15945 · Exploit
• 🔥 http://securityfocus.com/bid/45736 · Exploit
• http://vupen.com/english/advisories/2011/0072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0505 · Security Note
• http://secunia.com/advisories/42858 · Vendor Advisory
• http://osvdb.org/70395 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64557 · Note