PT-2007-2786 · Netforo! · Netforo!

Gold_M · Published 2007-03-10 · Updated 2017-10-11 · CVE-2007-1392

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions netForo! version 0.1g

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the down.php file. This is achieved by using a .. (dot dot) in the file to download parameter.

Recommendations For netForo! version 0.1g, restrict access to the down.php file to minimize the risk of exploitation. Avoid using the file to download parameter with unvalidated input until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-1392

Affected Products

Netforo!

References · 6

• 🔥 http://securityfocus.com/bid/22875 · Exploit
• 🔥 https://exploit-db.com/exploits/3435 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1392 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32878 · Note
• http://vupen.com/english/advisories/2007/0884 · Note
• http://secunia.com/advisories/24449 · Note