PT-2007-4675 · Dreamlog · Dreamlog

Dj7Xpl · Published 2007-06-26 · Updated 2017-10-11 · CVE-2007-3403

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dreamLog (aka dreamblog) version 0.5

Description The issue concerns an unrestricted file upload vulnerability. This allows remote attackers to upload and execute arbitrary PHP code in the uploads/images/ directory via the uploadedFile[] parameter in the upload.php file.

Recommendations For dreamLog (aka dreamblog) version 0.5, restrict access to the upload.php file to prevent arbitrary file uploads, and consider validating and sanitizing the uploadedFile[] parameter to prevent code execution.

Exploit

Fix

Related Identifiers

CVE-2007-3403

Affected Products

Dreamlog

References · 6

• 🔥 https://exploit-db.com/exploits/4106 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3403 · Security Note
• http://securityfocus.com/bid/24639 · Note
• http://osvdb.org/45385 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35054 · Note
• http://vupen.com/english/advisories/2007/2326 · Note