6.8

CVE-2008-7123

Exploit
Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular expression check.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zkup ≫ Zkup Version 2.0
Zkup ≫ Zkup Version 2.01
Zkup ≫ Zkup Version 2.02
Zkup ≫ Zkup Version 2.03
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.06% 0.893
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://osvdb.org/43082
http://secunia.com/advisories/29276
Vendor Advisory
http://www.securityfocus.com/bid/28149
Exploit
http://www.zkup.fr/actualite-zkup/maj-critique-v203v204.html
Patch
https://www.exploit-db.com/exploits/5220