PT-2008-4103 · Cmsimple · Cmsimple

Irk4Z · Published 2008-06-10 · Updated 2017-09-29 · CVE-2008-2650

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CMSimple version 3.1

Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files by providing a .. (dot dot) in the sl parameter to "index.php". This can be used for remote file execution by including "adm.php" and then invoking the upload action.

Recommendations For CMSimple version 3.1, update to the patched version released on 20080601, even though the version number remains unchanged.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-2650

Affected Products

Cmsimple

References · 9

• 🔥 http://securityfocus.com/bid/29450 · Exploit
• 🔥 https://exploit-db.com/exploits/5700 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2650 · Security Note
• http://secunia.com/advisories/30463 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42793 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42792 · Note
• http://cmsimple.com/forum/viewtopic.php?f=2&t=17 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2650 · Note
• http://osvdb.org/45881 · Note