PT-2012-3125 · Base · Basic Analysis/Security Engine

Published 2012-02-18 · Updated 2017-08-29 · CVE-2012-1198

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine (BASE) version 1.4.5

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a create action, and then accessing it via a view action. This is made possible through the base ag main.php file in the affected software.

Recommendations For Basic Analysis and Security Engine (BASE) version 1.4.5, consider restricting access to the base ag main.php file to prevent remote attackers from uploading and executing arbitrary code until a patch is available. As a temporary workaround, avoid using the create and view actions in base ag main.php to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-1198

Affected Products

Basic Analysis/Security Engine

References · 6

• 🔥 http://securityfocus.com/bid/51979 · Exploit
• 🔥 https://exploit-db.com/exploits/36760 · Exploit
• 🔥 http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1198 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73201 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1198 · Note