CVE-2007-3586
published 2007-07-05CVE-2007-3586: Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into (1) a _score.txt file…
PriorityP339high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.31%
81.3th percentile
Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into (1) a _score.txt file via the score parameter, or (2) a _setby.txt file via a login cookie, which is then included by games.php. NOTE: programs that use games.php might include (a) snakep.php, (b) tetrisp.php, and possibly other site-specific files.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mycms | mycms | <= 0.9.8 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
CoreHTTP Web server 0.5.3.1 - Off-by-One Buffer Overflow
exploitdb·2009-12-02·CVSS 9.0
CVE-2009-3586 [CRITICAL] CoreHTTP Web server 0.5.3.1 - Off-by-One Buffer Overflow
CoreHTTP Web server 0.5.3.1 - Off-by-One Buffer Overflow
---
# bugtraq: http://seclists.org/bugtraq/2009/Dec/99
# census ID: census-2009-0003
# URL: http://census-labs.com/news/2009/12/02/corehttp-web-server/
# CVE ID: CVE-2009-3586
# Affected Products: CoreHTTP web server versions buffer,
# 46: "%" PATHSIZE_S "[A-Za-z] %" PATHSIZE_S "s%*[ \t\n]", req, url);
#
# The buffers req and url are declared to be of size 256 bytes (PATHSIZE)
# and the sscanf() call writes 256 bytes (PATHSIZE_S) to these buffers
# without NULL terminating them.
#
# Note that this is not vulnerability CVE-2007-4060 in which the same
# sscanf() call contained no bounds check at all.
#
# This vulnerability can lead to denial of service attacks against the
# CoreHTTP web server and potentially to the remote execution
Exploit-DB
MyCMS 0.9.8 - Remote Command Execution (2)
exploitdb·2007-07-03
CVE-2007-3586 MyCMS 0.9.8 - Remote Command Execution (2)
MyCMS 0.9.8 - Remote Command Execution (2)
---
#!/usr/bin/php -q -d short_open_tag=on
Thanks to rgod for the php code and Marty for the Love
";
if ($argcNo new score set";
}
elseif ($score > $data) {
$file1 = "snake_score.txt";
$file2 = "snake_setby.txt";
$file1h = fopen($file1, 'w') or die("can't open file");
$file2h = fopen($file2, 'w') or die("can't open file");
fwrite($file1h, $score);
fclose($file1h);
fwrite($file2h, $by);
fclose($file2h);
echo "A new Top Score has been Set!!!!";
}
ok, we can put our code into a txt file, but then?
look at this (games.php):
if (isset($_GET['scoreid'])) {
echo "Top Score for this game: ";
include($_GET['scoreid'] . "_score.txt");
echo ", Set By:";
include($_GET['scoreid'] . "_setby.txt");
}
setting properly our scoreid var we can perform an in
No writeups or analysis indexed.
http://osvdb.org/45778http://www.securityfocus.com/bid/24757https://exchange.xforce.ibmcloud.com/vulnerabilities/35254https://www.exploit-db.com/exploits/4144http://osvdb.org/45778http://www.securityfocus.com/bid/24757https://exchange.xforce.ibmcloud.com/vulnerabilities/35254https://www.exploit-db.com/exploits/4144
2007-07-05
Published