PT-2008-2057 · Frimousse · Frimousse

Houssamix · Published 2008-01-23 · Updated 2017-09-29 · CVE-2008-0425

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frimousse version 0.0.2

Description The issue allows remote attackers to read arbitrary files and list arbitrary directories via a full pathname in the name parameter. This is due to an absolute path traversal vulnerability in the explorerdir.php file.

Recommendations For Frimousse version 0.0.2, consider restricting access to the explorerdir.php file or the name parameter to prevent exploitation until a fix is available. As a temporary workaround, avoid using the name parameter with full pathnames in the explorerdir.php file.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-0425

Affected Products

Frimousse

References · 5

• 🔥 https://exploit-db.com/exploits/4943 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0425 · Security Note
• http://vupen.com/english/advisories/2008/0216 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39797 · Note
• http://securityfocus.com/bid/27385 · Note