ID de Prueba:	1.3.6.1.4.1.25623.1.0.900356
Categoría:	Web application abuses
Título:	Bitweaver Directory Traversal And Code Injection Vulnerabilities
Resumen:	Bitweaver, is prone to directory traversal and code injection vulnerabilities.
Descripción:	Summary: Bitweaver, is prone to directory traversal and code injection vulnerabilities. Vulnerability Insight: Multiple flaws are due to improper handling of user supplied input in saveFeed function in rss/feedcreator.class.php file and it can cause following attacks. - PHP code injection via placing PHP sequences into the account 'display name' setting for authenticated users or in the HTTP Host header for remote users by sending a request to boards/boards_rss.php. - Directory traversal allow remote user to create or overwrite arbitrary file via a .. (dot dot) in the version parameter to boards/boards_rss.php. Vulnerability Impact: Successful exploitation will let the attacker to cause PHP code injection, directory traversal, gain sensitive information, and can cause arbitrary code execution inside the context of the web application. Affected Software/OS: Bitweaver version 2.6.0 and prior Solution: Upgrade to Bitweaver version 2.6.1 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1677 BugTraq ID: 34910 http://www.securityfocus.com/bid/34910 Bugtraq: 20090512 Bitweaver <= 2.6 /boards/boards_rss.php / saveFeed() remote code execution exploit (Google Search) http://www.securityfocus.com/archive/1/503435 https://www.exploit-db.com/exploits/8659 http://secunia.com/advisories/35057 XForce ISS Database: bitweaver-savefeed-code-execution(50631) https://exchange.xforce.ibmcloud.com/vulnerabilities/50631 Common Vulnerability Exposure (CVE) ID: CVE-2009-1678
Copyright	Copyright (C) 2009 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.