PT-2010-5475

CVE-2010-4399

·

Publicado

2010-12-04

·

Atualizado

2021-03-25

Descrição por

CVSS 2.0
4.3
Média
MétricasAV:N/AC:M/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions DynPG CMS versions 4.1.1 through 4.2.0
Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the languages.inc.php file when magic quotes gpc is disabled. This can be exploited by sending a .. (dot dot) in the CHG DYNPG SET LANGUAGE parameter to "index.php".
Recommendations For DynPG CMS versions 4.1.1 through 4.2.0, consider disabling the CHG DYNPG SET LANGUAGE parameter in the "index.php" file until a patch is available, or enable magic quotes gpc to prevent the directory traversal vulnerability.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Identificadores relacionados
CVE-2010-4399
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com