PT-2013-6290 · Iscripts · Iscripts Autohoster

0U7 5M4R7 · Published 2013-12-20 · Updated 2017-08-29 · CVE-2013-7190

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions iScripts AutoHoster version 2.4

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to read arbitrary files via specific parameters in various PHP files. The affected parameters include tmpid in "websitebuilder/showtemplateimage.php", fname in "admin/downloadfile.php", and id in "support/admin/csvdownload.php". Additionally, there is an unspecified impact via unspecified vectors in "support/parser/main smtp.php".

Recommendations For iScripts AutoHoster version 2.4, consider restricting access to the vulnerable parameters tmpid, fname, and id in their respective PHP files until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints. Also, restrict access to "support/parser/main smtp.php" to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-7190

Affected Products

Iscripts Autohoster

References · 7

• 🔥 https://exploit-db.com/exploits/38891 · Exploit
• 🔥 https://exploit-db.com/exploits/38892 · Exploit
• 🔥 https://exploit-db.com/exploits/38889 · Exploit
• 🔥 https://exploit-db.com/exploits/38890 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-7190 · Security Note
• http://seclists.org/fulldisclosure/2013/Dec/121 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89818 · Note