PT-2023-10188 · Unknown · Interchange

Published 2023-01-02 · Updated 2024-05-17 · CVE-2015-10009

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nterchange versions up to 4.1.0

Description A critical issue affects the function getContent of the file app/controllers/code caller controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/* leads to code injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.1 is able to address this issue.

Recommendations For nterchange versions up to 4.1.0, upgrade to version 4.1.1 to address the issue. As a temporary workaround, consider restricting the input for the argument q to prevent code injection.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2015-10009

GHSA-CP2P-6XH4-JMCP

Affected Products

Interchange

References · 9

• https://github.com/nonfiction/nterchange_backend/commit/fba7d89176fba8fe289edd58835fe45080797d99 · Patch
• https://github.com/nonfiction/nterchange_backend/releases/tag/4.1.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10009 · Security Note
• https://osv.dev/vulnerability/GHSA-cp2p-6xh4-jmcp · Vendor Advisory
• https://github.com/nonfiction/nterchange_backend · Note
• https://t.me/cvenotify/41111 · Telegram Post
• https://vuldb.com/?ctiid.217187 · Note
• https://vuldb.com/?id.217187 · Note
• https://t.me/cibsecurity/55740 · Telegram Post