Drake CMS の index.php における CRLF インジェクションの脆弱性
| Title |
Drake CMS の index.php における CRLF インジェクションの脆弱性
|
| Summary |
Drake CMS の index.php には、CRLF インジェクションの脆弱性が存在します。
|
| Possible impacts |
第三者により、lang パラメータの CRLF シーケンスを介して、攻撃分割しながら任意の HTTP ヘッダを挿入される、および HTTP レスポンスを実行される可能性があります。 |
| Solution |
ベンダ情報および参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
May 11, 2007, midnight |
| Registration Date |
June 26, 2012, 3:46 p.m. |
| Last Update |
June 26, 2012, 3:46 p.m. |
|
CVSS2.0 : 警告
|
| Score |
5.1
|
| Vector |
AV:N/AC:H/Au:N/C:P/I:P/A:P |
Affected System
| drake team |
|
drake cms 0.4.0
|
CVE (情報セキュリティ 共通脆弱性識別子)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 0 |
[2012年06月26日]
掲載 |
Feb. 17, 2018, 10:37 a.m. |
NVD Vulnerability Information
CVE-2007-2618
| Summary |
CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
|
| Summary |
In order to make the exploit work, the attacker would have to craft a webpage (hosted on the same domain as the Drake CMS website) and have the Drake CMS user make a post from that page.
Successful exploitation requires that "register_globals" is enabled.
|
| Publication Date |
May 12, 2007, 1:19 a.m. |
| Registration Date |
Jan. 29, 2021, 2:12 p.m. |
| Last Update |
Oct. 17, 2018, 1:44 a.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:drake_team:drake_cms:0.4.0:*:*:*:*:*:*:* |
|
|
|
|
Related information, measures and tools
Common Vulnerabilities List