PT-2020-12127 · Chadha · Chadha Phpkb Standard Multi-Language

Published 2020-03-12 · Updated 2022-10-06 · CVE-2020-10457

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Chadha PHPKB Standard Multi-Language version 9

Description The issue allows attackers to rename any file on the web server by exploiting a path traversal vulnerability. This is achieved by using a dot-dot-slash sequence (../) via the imgName and imgUrl parameters in the POST request. The imgName parameter is used for the new name, and the imgUrl parameter is used for the current file to be renamed.

Recommendations For Chadha PHPKB Standard Multi-Language version 9, consider validating and sanitizing the imgName and imgUrl parameters to prevent path traversal attacks. As a temporary workaround, restrict access to the admin/imagepaster/image-renaming.php script to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-10457

Affected Products

Chadha Phpkb Standard Multi-Language

References · 4

• 🔥 https://antoniocannito.it/phpkb1#arbitrary-file-renaming-cve-2020-10457 · Exploit
• 🔥 http://antoniocannito.it/?p=137#afr · Exploit
• https://osv.dev/vulnerability/CVE-2020-10457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10457 · Security Note