Lucene search

[email protected]CVE-2008-7123

HistoryAug 31, 2009 - 10:30 a.m.

CVE-2008-7123

2009-08-3110:30:00

CWE-94

[email protected]

web.nvd.nist.gov

cve

2008

admin

configuration

modifier.php

zkup cms

code injection

vulnerability

remote attackers

php

null byte

regular expression

security

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

Low

0.013 Low

EPSS

Percentile

86.2%

JSON

Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular expression check.

Affected configurations

NVD

Node

zkupzkupMatch2.0

zkupzkupMatch2.01

zkupzkupMatch2.02

zkupzkupMatch2.03

CPENameOperatorVersion
zkup:zkupzkupeq2.0
zkup:zkupzkupeq2.01
zkup:zkupzkupeq2.02
zkup:zkupzkupeq2.03

CPE	Name	Operator	Version
zkup:zkup	zkup	eq	2.0
zkup:zkup	zkup	eq	2.01
zkup:zkup	zkup	eq	2.02
zkup:zkup	zkup	eq	2.03

References

osvdb.org/43082

secunia.com/advisories/29276

www.securityfocus.com/bid/28149

www.zkup.fr/actualite-zkup/maj-critique-v203v204.html

www.exploit-db.com/exploits/5220

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.5 High

AI Score

Confidence

Low

0.013 Low

EPSS

Percentile

86.2%

JSON

Related for CVE-2008-7123

prion1 nvd1 cvelist1