PT-2009-4667
CVE-2009-2218
·
تاريخ النشر
2009-06-25
·
تاريخ التحديث
2017-09-19
الوصف من
CVSS 2.0
6.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
phpCollegeExchange version 0.1.5c
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL in the
home parameter to several PHP files, including (1) i head.php, (2) i nav.php, (3) user new 2.php, or (4) house/myrents.php, when register globals is enabled. Additionally, similar issues exist in (5) allbooks.php, (6) home.php, or (7) mybooks.php in the books/ directory.Recommendations
For phpCollegeExchange version 0.1.5c, consider disabling the
register globals setting to prevent exploitation. As a temporary workaround, restrict access to the vulnerable PHP files, including i head.php, i nav.php, user new 2.php, house/myrents.php, allbooks.php, home.php, and mybooks.php, until a patch is available. Avoid using the home parameter in the affected PHP files until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾