CVE-2010-0366

Multiple unrestricted file upload vulnerabilities in (1) register.php and (2) addvideo.php in BitScripts Bits Video Script 2.04 and 2.05 Gold Beta allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/61826
http://secunia.com/advisories/38252	Vendor Advisory
http://www.packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/55738
http://osvdb.org/61826
http://secunia.com/advisories/38252	Vendor Advisory
http://www.packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/55738

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bitscripts:bits_video_script:2.04:::::::*
	cpe:2.3:a:bitscripts:bits_video_script:2.05:gold_beta::::::

History

21 Nov 2024, 01:12

Type	Values Removed	Values Added
References	~~() http://osvdb.org/61826 -~~	() http://osvdb.org/61826 -
References	~~() http://secunia.com/advisories/38252 - Vendor Advisory~~	() http://secunia.com/advisories/38252 - Vendor Advisory
References	~~() http://www.packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt - Exploit~~	() http://www.packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/55738 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/55738 -

Information

Published : 2010-01-21 20:30

Updated : 2024-11-21 01:12

NVD link : CVE-2010-0366

Mitre link : CVE-2010-0366

CVE.ORG link : CVE-2010-0366

JSON object : View

Products Affected

bitscripts

bits_video_script

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2010-0366", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-01-21T20:30:00.663", "references": [{"url": "http://osvdb.org/61826", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/38252", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55738", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/61826", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/38252", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55738", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Multiple unrestricted file upload vulnerabilities in (1) register.php and (2) addvideo.php in BitScripts Bits Video Script 2.04 and 2.05 Gold Beta allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de subida de archivos sin restricci\u00f3n (1) register.php y (2) addvideo.php en BitScripts Bits Video Script v2.04 y v2.05 Gold Beta, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n subiendo un archivo con una extensi\u00f3n ejecutable y accediendo a \u00e9l a trav\u00e9s de una petici\u00f3n directa sobre un directorio no especificado"}], "lastModified": "2024-11-21T01:12:04.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bitscripts:bits_video_script:2.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B0AA93D-67E0-4B92-9655-FA68D69BF54B"}, {"criteria": "cpe:2.3:a:bitscripts:bits_video_script:2.05:gold_beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D19290-7F5C-4382-A7E3-D7679031F2E9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}