CVE-2009-0677
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.7 High
AI Score
Confidence
High
0.018 Low
EPSS
Percentile
88.4%
avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the preg_replace function with the eval switch, as specified in an element of the patterns array.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ravenphpscripts:ravennuke | ravenphpscripts ravennuke | eq | 2.30 |
References
ravenphpscripts.com/postt17156.html&sid=12d1201371612260a42fa846ebce7bad
secunia.com/advisories/33928
www.osvdb.org/52007
www.securityfocus.com/archive/1/500988/100/0/threaded
www.securityfocus.com/bid/33787
www.waraxe.us/advisory-72.html
exchange.xforce.ibmcloud.com/vulnerabilities/48789
www.exploit-db.com/exploits/8068
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.7 High
AI Score
Confidence
High
0.018 Low
EPSS
Percentile
88.4%