CVE-2005-3010 Code injection in n/a
Remote attackers can execute arbitrary PHP code via the HTTP_CLIENT_IP header in CuteNews flood protection, requiring immediate upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2005-3010?
CVE-2005-3010 is a high-severity code injection vulnerability in n/a, published on 21 Sep 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.
Which versions are affected by CVE-2005-3010?
It affects 1 product.
Products include Cutephp Cutenews.
How do I fix CVE-2005-3010?
No fix has been published for CVE-2005-3010 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2005-3010 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-3010 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2j7c-c562-m564.