PT-2007-2077 · Fd · Fd Script

Ajann · Publicado 2007-01-31 · Atualizado 2018-10-16 · CVE-2007-0620

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FD Script versions 1.3.2 and earlier

Description The issue allows remote attackers to read the source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter. This can be demonstrated by downloading config.php.

Recommendations For FD Script versions 1.3.2 and earlier, avoid using the fname parameter in the download.php file until the issue is resolved. As a temporary workaround, consider restricting access to sensitive files, such as config.php, to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-0620

Produtos afetados

Fd Script

Referências · 10

• 🔥 https://exploit-db.com/exploits/29530 · Exploit
• 🔥 https://exploit-db.com/exploits/3203 · Exploit
• 🔥 http://securityfocus.com/bid/22265 · Exploit
• http://secunia.com/advisories/23947 · Aviso do Fabricante
• http://osvdb.org/33001 · Nota
• http://securityreason.com/securityalert/2197 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0620 · Nota de Segurança
• http://vupen.com/english/advisories/2007/0383 · Nota
• http://securityfocus.com/archive/1/458231/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31915 · Nota