PT-2007-6717 · Elouai · Elouai'S Force Download

Xcross87 · Published 2007-10-30 · Updated 2018-10-15 · CVE-2007-5732

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions eLouai's Force Download of media files script versions 20071030 and earlier

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files via the file parameter in the "downloadfile.php" script. This issue is notable in environments where the system administrator has not followed vendor recommendations to use the product only internally.

Recommendations For versions 20071030 and earlier, consider restricting access to the "downloadfile.php" script until a fix is available, and ensure the product is used only internally as recommended by the vendor.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5732

Affected Products

Elouai'S Force Download

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5732 · Security Note
• http://elouai.com/force-download.php · Note
• http://securityreason.com/securityalert/3321 · Note
• http://osvdb.org/39011 · Note
• http://securityfocus.com/archive/1/482679/100/0/threaded · Note