PT-2008-4582 · Fuzzylime · Fuzzylime

Published 2008-07-14 · Updated 2017-09-29 · CVE-2008-3164

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: fuzzylime (cms) versions 3.01 through 3.01a

Description: The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter when magic quotes gpc is disabled.

Recommendations: For versions 3.01 through 3.01a, consider disabling the execution of files using the file parameter in the blog.php script until a patch is available. Restrict access to the blog.php script to minimize the risk of exploitation. Avoid using the file parameter in the blog.php script until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3164

Affected Products

Fuzzylime

References · 9

• 🔥 https://exploit-db.com/exploits/6016 · Exploit
• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/30121.pl · Exploit
• 🔥 http://securityfocus.com/bid/30121 · Exploit
• 🔥 https://exploit-db.com/exploits/32016 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3164 · Security Note
• http://secunia.com/advisories/30930 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2015/references · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43606 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43939 · Note