PT-2007-1806 · Jax · Jax Petition Book

Published 2007-01-18 · Updated 2018-10-16 · CVE-2007-0335

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jax Petition Book version 1.0.3.06

Description: The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the languagepack parameter to API endpoints such as "jax petitionbook.php" or "smileys.php".

Recommendations: For Jax Petition Book version 1.0.3.06, consider restricting access to the languagepack parameter in the affected API endpoints "jax petitionbook.php" and "smileys.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0335

Affected Products

Jax Petition Book

References · 13

• 🔥 https://exploit-db.com/exploits/29468 · Exploit
• 🔥 https://exploit-db.com/exploits/29469 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0335 · Security Note
• http://vupen.com/english/advisories/2007/0220 · Note
• http://secunia.com/advisories/23784 · Note
• http://securityfocus.com/bid/22072 · Note
• http://securityfocus.com/archive/1/457077/100/0/threaded · Note
• http://osvdb.org/32835 · Note
• http://securityreason.com/securityalert/2161 · Note
• http://securityfocus.com/archive/1/456981/100/0/threaded · Note
• http://osvdb.org/32836 · Note
• http://securityfocus.com/archive/1/456989/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31543 · Note