PT-2008-3840 · Smeego · Smeego

0In · Published 2008-05-20 · Updated 2018-10-11 · CVE-2008-2352

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Smeego version 1.0

Description: The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, when magic quotes gpc is disabled. This is a directory traversal vulnerability in the index.php file.

Recommendations: For Smeego version 1.0, consider disabling the index.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent the exploitation of this issue. Restrict the use of the lang cookie to minimize the risk of directory traversal attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-2352

Affected Products

Smeego

References · 7

• 🔥 https://exploit-db.com/exploits/5640 · Exploit
• http://secunia.com/advisories/30138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2352 · Security Note
• http://vupen.com/english/advisories/2008/1563/references · Note
• http://securityfocus.com/bid/29264 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42498 · Note
• http://securityfocus.com/archive/1/492227/100/0/threaded · Note