PT-2008-4931 · Wsn · Wsn Forum+4

Otmorozok428 · Published 2008-08-08 · Updated 2017-09-29 · CVE-2008-3555

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WSN Forum versions 4.1.43 and earlier Gallery versions 4.1.30 and earlier Knowledge Base (WSNKB) versions 4.1.36 and earlier Links versions 4.1.44 and earlier Classifieds versions prior to 4.1.30

Description A directory traversal issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter. This can be exploited by uploading a file, such as a .jpg file, containing PHP sequences.

Recommendations For WSN Forum versions 4.1.43 and earlier, update to a version later than 4.1.43. For Gallery versions 4.1.30 and earlier, update to a version later than 4.1.30. For Knowledge Base (WSNKB) versions 4.1.36 and earlier, update to a version later than 4.1.36. For Links versions 4.1.44 and earlier, update to a version later than 4.1.44. For Classifieds versions prior to 4.1.30, update to version 4.1.30 or later. As a temporary workaround, consider restricting access to the TID parameter in the affected index.php file until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3555

Affected Products

Aj Classifieds

Gallery

Wp Knowledgebase

Links

Wsn Forum

References · 6

• 🔥 https://exploit-db.com/exploits/6208 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3555 · Security Note
• http://secunia.com/advisories/31392 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44236 · Note
• http://securityreason.com/securityalert/4120 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3555 · Note