PT-2007-6306 · Alstrasoft · Alstrasoft Affiliate Network Pro

Published 2007-10-05 · Updated 2018-10-15 · CVE-2007-5223

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: AlstraSoft Affiliate Network Pro (affected versions not specified)

Description: The issue is related to multiple unspecified vulnerabilities that allow remote attackers to include local files and have other unspecified impact. This is due to incorrect input validation or other defects involving certain files and parameters, such as admin/backupstart.php, .sql filenames under admin/admin/dump/, the fl parameter to admin/downloadbackup.php, and the use of .. (dot dot) in the fl parameter to admin/downloadbackup.php.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-5223

Affected Products

Alstrasoft Affiliate Network Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-5223 · Security Note
• http://osvdb.org/42342 · Note
• http://securityfocus.com/bid/25882 · Note
• http://vupen.com/english/advisories/2007/3344 · Note
• http://osvdb.org/42343 · Note
• http://securityfocus.com/archive/1/481206/100/0/threaded · Note
• http://securityreason.com/securityalert/3191 · Note
• http://osvdb.org/42344 · Note