CVE-2007-0649

23Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendepss 6.2%

de la publicación al arma0 días

Publicada en NVD1 feb

1ª PoC31 ene

probabilidad de explotación

6.2%top 7% de las CVE

explotación observada

noninguna fuente lo reporta

2 exploit(s) público(s)

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also, the original report identified "Open Conference Systems," but this was an error.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29556 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29557

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://attrition.org/pipermail/vim/2007-January/001254.html http://attrition.org/pipermail/vim/2007-January/001258.html http://osvdb.org/33603 http://osvdb.org/33609 http://securityreason.com/securityalert/2202 http://www.securityfocus.com/archive/1/458306/100/0/threaded http://www.securityfocus.com/archive/1/458426/100/0/threaded http://www.securityfocus.com/archive/1/458456/100/0/threaded http://www.securityfocus.com/archive/1/458476/100/0/threaded http://www.securityfocus.com/archive/1/458486/100/0/threaded http://www.securityfocus.com/archive/1/458565/100/0/threaded http://www.securityfocus.com/bid/22346