PT-2008-2057 · Frimousse · Frimousse

Houssamix · Publicado 2008-01-23 · Atualizado 2017-09-29 · CVE-2008-0425

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frimousse version 0.0.2

Description The issue allows remote attackers to read arbitrary files and list arbitrary directories via a full pathname in the name parameter. This is due to an absolute path traversal vulnerability in the explorerdir.php file.

Recommendations For Frimousse version 0.0.2, consider restricting access to the explorerdir.php file or the name parameter to prevent exploitation until a fix is available. As a temporary workaround, avoid using the name parameter with full pathnames in the explorerdir.php file.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-0425

Produtos afetados

Frimousse

Referências · 5

• 🔥 https://exploit-db.com/exploits/4943 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0425 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0216 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39797 · Nota
• http://securityfocus.com/bid/27385 · Nota