Test Kennung:	1.3.6.1.4.1.25623.1.0.900356
Kategorie:	Web application abuses
Titel:	Bitweaver Directory Traversal And Code Injection Vulnerabilities
Zusammenfassung:	This host is running Bitweaver, which is prone to directory traversal and; code injection vulnerabilities.
Beschreibung:	Summary: This host is running Bitweaver, which is prone to directory traversal and code injection vulnerabilities. Vulnerability Insight: Multiple flaws are due to improper handling of user supplied input in saveFeed function in rss/feedcreator.class.php file and it can cause following attacks. - PHP code injection via placing PHP sequences into the account 'display name' setting for authenticated users or in the HTTP Host header for remote users by sending a request to boards/boards_rss.php. - Directory traversal allow remote user to create or overwrite arbitrary file via a .. (dot dot) in the version parameter to boards/boards_rss.php. Vulnerability Impact: Successful exploitation will let the attacker to cause PHP code injection, directory traversal, gain sensitive information, and can cause arbitrary code execution inside the context of the web application. Affected Software/OS: Bitweaver version 2.6.0 and prior Solution: Upgrade to Bitweaver version 2.6.1 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Querverweis:	BugTraq ID: 34910 Common Vulnerability Exposure (CVE) ID: CVE-2009-1677 http://www.securityfocus.com/bid/34910 Bugtraq: 20090512 Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code execution exploit (Google Search) http://www.securityfocus.com/archive/1/503435 https://www.exploit-db.com/exploits/8659 http://secunia.com/advisories/35057 XForce ISS Database: bitweaver-savefeed-code-execution(50631) https://exchange.xforce.ibmcloud.com/vulnerabilities/50631 Common Vulnerability Exposure (CVE) ID: CVE-2009-1678
Copyright	Copyright (C) 2009 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.