6.8

CVE-2008-6793

Exploit
The get_file_type function in lib/file_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dflabs ≫ Ptk Version0.1
Dflabs ≫ Ptk Version0.2
Dflabs ≫ Ptk Version1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.93% 0.933
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://osvdb.org/49574
http://secunia.com/advisories/32553
http://www.ikkisoft.com/stuff/LC-2008-07.txt
http://www.securityfocus.com/archive/1/498081/100/0/threaded
http://www.securityfocus.com/bid/32128
Exploit
http://www.vupen.com/english/advisories/2008/3020
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/46380
https://www.exploit-db.com/exploits/7001