PT-2008-2173 · Unknown · Bubbling Library

Stack-Terrorist · Publicado 2008-02-01 · Atualizado 2017-09-29 · CVE-2008-0545

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bubbling Library version 1.32

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to include and execute arbitrary local files. The attack can be performed by including a .. (dot dot) in specific parameters. The affected parameters are the uri parameter in files such as yui-menu.tpl.php, simple.tpl.php, and advanced.tpl.php, and the page parameter in files like yui-menu.php, simple.php, and advanced.php, all located in the dispatcher/framework/ directory.

Recommendations For Bubbling Library version 1.32, consider restricting access to the dispatcher/framework/ directory to minimize the risk of exploitation. As a temporary workaround, avoid using the uri and page parameters in the affected files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0545

Produtos afetados

Bubbling Library

Referências · 5

• 🔥 https://exploit-db.com/exploits/4991 · Exploit
• 🔥 http://securityfocus.com/bid/27466 · Exploit
• http://vupen.com/english/advisories/2008/0347 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39969 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0545 · Nota de Segurança