PT-2004-1456 · Owls · Owls

G00Db0Y · Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0302

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OWLS version 1.0

Description A directory traversal issue allows remote attackers to read arbitrary files by using a .. (dot dot) in specific parameters. This can be achieved through the file parameter in "index.php", the editfile parameter in "glossary.php", or the editfile parameter in "newmultiplechoice.php".

Recommendations For OWLS version 1.0, consider restricting access to the file, editfile parameters in the affected API endpoints until a patch is available. As a temporary workaround, avoid using the file parameter in "index.php" and the editfile parameter in "glossary.php" and "newmultiplechoice.php" to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-0302

Affected Products

Owls

References · 8

• 🔥 https://exploit-db.com/exploits/23724 · Exploit
• 🔥 http://securityfocus.com/bid/9689 · Exploit
• 🔥 https://exploit-db.com/exploits/23723 · Exploit
• 🔥 https://exploit-db.com/exploits/23722 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0302 · Security Note
• http://marc.info/?l=bugtraq&m=107712123305706&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15249 · Note
• http://zone-h.org/en/advisories/read/id=3973 · Note