PT-2007-6717 · Elouai · Elouai'S Force Download

Xcross87 · Publicado 2007-10-30 · Atualizado 2018-10-15 · CVE-2007-5732

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions eLouai's Force Download of media files script versions 20071030 and earlier

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files via the file parameter in the "downloadfile.php" script. This issue is notable in environments where the system administrator has not followed vendor recommendations to use the product only internally.

Recommendations For versions 20071030 and earlier, consider restricting access to the "downloadfile.php" script until a fix is available, and ensure the product is used only internally as recommended by the vendor.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5732

Produtos afetados

Elouai'S Force Download

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5732 · Nota de Segurança
• http://elouai.com/force-download.php · Nota
• http://securityreason.com/securityalert/3321 · Nota
• http://osvdb.org/39011 · Nota
• http://securityfocus.com/archive/1/482679/100/0/threaded · Nota