Vulnerabilities > CVE-2008-0175 - Remote Script Code Execution vulnerability in GE Fanuc Proficy Portal

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
ge-fanuc
exploit available

Summary

Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory.

Vulnerable Configurations

Part Description Count
Application
Ge_Fanuc
1

Exploit-Db

descriptionGE Fanuc Real Time Information Portal 2.6 writeFile() API Exploit (meta). CVE-2008-0175. Remote exploit for windows platform
idEDB-ID:6921
last seen2016-02-01
modified2008-11-01
published2008-11-01
reporterKevin Finisterre
sourcehttps://www.exploit-db.com/download/6921/
titleGE Fanuc Real Time Information Portal 2.6 writeFile API Exploit meta

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 27446 CVE(CAN) ID: CVE-2008-0175 Proficy Real-Time Information Portal是一个基于Web的解决方案,将基于在线和过程的系统与厂级连接性、分析和人机界面器件集成起来。 Proficy Real-Time Information Portal在处理用户请求时存在漏洞,远程攻击者可能利用此漏洞控制服务器。 Proficy Real-Time Information Portal没有对Add WebSource执行正确的Java RMI调用,允许用户设置放置文件位置的名称和路径,而文件本身的另一个参数是base64编码的内容。通过认证的攻击者可以通过在Web浏览器中请求文件使用Add WebSource选项向服务器的主虚拟目录上传任意文件,包括ASP文件,这样就可以完全入侵服务器。 GE Fanuc Proficy Real-Time Information Portal 2.6 临时解决方法: 如果您不能立刻安装补丁或者升级,NSFOCUS建议您采取以下措施以降低威胁: * 从Proficy目录删除IIS用户的写权限。 厂商补丁: GE Fanuc -------- 目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本: <a href=http://www.gefanuc.com/as_en/products_solutions/production_management/products/proficy_portal.html target=_blank>http://www.gefanuc.com/as_en/products_solutions/production_management/products/proficy_portal.html</a>
idSSV:2872
last seen2017-11-19
modified2008-01-30
published2008-01-30
reporterRoot
titleGE-Fanuc Proficy Real-Time Information Portal远程脚本上传及执行漏洞