CVE-2009-1677

Published May 18, 2009

Last updated 7 years ago

CVSS info 6.5

Overview

Description: Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and then invoking boards/boards_rss.php, and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B2241EB6-A886-4C04-8632-997D6CA4F228",
            "versionEndIncluding": "2.6"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A31BF87D-6D73-442A-9C6C-7926A2A3E8BC"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:1.1.1_beta:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "431C0A41-841E-48B2-88D3-B94A43F56D51"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:1.2.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA6E9A08-F938-4E3F-BA68-E307E839335B"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:1.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5657A816-9C53-4D97-90C4-357FCCA7057D"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:1.3.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D6D44BA4-E55B-4E4A-B7CE-C5C347FB3902"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:2.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8E3F9B77-302B-4EB0-B103-594CB366F880"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:2.0.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BAA2896F-D3E4-489D-A08F-7B2E926182C0"
          },
          {
            "criteria": "cpe:2.3:a:bitweaver:bitweaver:2.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA9025B9-B31C-4D82-9FA0-864C3F19C7A1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 2.0

Weaknesses

Social media

Configurations

References