PT-2008-2173 · Unknown · Bubbling Library

Stack-Terrorist · Published 2008-02-01 · Updated 2017-09-29 · CVE-2008-0545

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bubbling Library version 1.32

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to include and execute arbitrary local files. The attack can be performed by including a .. (dot dot) in specific parameters. The affected parameters are the uri parameter in files such as yui-menu.tpl.php, simple.tpl.php, and advanced.tpl.php, and the page parameter in files like yui-menu.php, simple.php, and advanced.php, all located in the dispatcher/framework/ directory.

Recommendations For Bubbling Library version 1.32, consider restricting access to the dispatcher/framework/ directory to minimize the risk of exploitation. As a temporary workaround, avoid using the uri and page parameters in the affected files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0545

Affected Products

Bubbling Library

References · 5

• 🔥 https://exploit-db.com/exploits/4991 · Exploit
• 🔥 http://securityfocus.com/bid/27466 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0545 · Security Note
• http://vupen.com/english/advisories/2008/0347 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39969 · Note