PT-2014-2911 · Sharetronix · Sharetronix

Published 2014-06-13 · Updated 2017-08-29 · CVE-2013-5352

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sharetronix versions 3.1.1.3, 3.1.1, and earlier

Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via two parameters: activities text to the "services/activities/set" endpoint or comments text to the "services/comments/set" endpoint. The vulnerability arises from improper handling when executing the preg replace function with the e modifier.

Recommendations For Sharetronix versions 3.1.1.3, 3.1.1, and earlier, consider disabling the preg replace function with the e modifier until a patch is available. Restrict access to the "services/activities/set" and "services/comments/set" endpoints to minimize the risk of exploitation. Avoid using the activities text and comments text parameters in the affected endpoints until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-5352

Affected Products

Sharetronix

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-5352 · Security Note
• http://secunia.com/secunia_research/2013-8 · Note
• http://osvdb.org/100605 · Note
• http://securityfocus.com/bid/64102 · Note
• http://secunia.com/advisories/53936 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89503 · Note
• http://osvdb.org/100606 · Note