PT-2007-2077 · Fd · Fd Script

Ajann · Published 2007-01-31 · Updated 2018-10-16 · CVE-2007-0620

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FD Script versions 1.3.2 and earlier

Description The issue allows remote attackers to read the source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter. This can be demonstrated by downloading config.php.

Recommendations For FD Script versions 1.3.2 and earlier, avoid using the fname parameter in the download.php file until the issue is resolved. As a temporary workaround, consider restricting access to sensitive files, such as config.php, to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0620

Affected Products

Fd Script

References · 10

• 🔥 https://exploit-db.com/exploits/29530 · Exploit
• 🔥 https://exploit-db.com/exploits/3203 · Exploit
• 🔥 http://securityfocus.com/bid/22265 · Exploit
• http://secunia.com/advisories/23947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0620 · Security Note
• http://osvdb.org/33001 · Note
• http://securityreason.com/securityalert/2197 · Note
• http://vupen.com/english/advisories/2007/0383 · Note
• http://securityfocus.com/archive/1/458231/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31915 · Note