6.8

CVE-2008-0300

Exploit
mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename that contains those sequences.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mapbender ≫ Mapbender Version2.4
Mapbender ≫ Mapbender Version2.4.1
Mapbender ≫ Mapbender Version2.4.2
Mapbender ≫ Mapbender Version2.4.3
Mapbender ≫ Mapbender Version2.4.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.99% 0.781
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://secunia.com/advisories/29329
http://www.redteam-pentesting.de/advisories/rt-sa-2008-001.php
Exploit
http://www.securityfocus.com/bid/28195
Patch
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/41131
https://www.exploit-db.com/exploits/5232