PT-2008-4940 · Dayfox · Dayfox Blog

Hadihadi · Published 2008-08-10 · Updated 2017-09-29 · CVE-2008-3564

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dayfox Blog version 4

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p, cat, and archive parameters in index.php. This can potentially be leveraged for remote file inclusion in certain environments by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Recommendations For Dayfox Blog version 4, consider restricting access to the p, cat, and archive parameters in index.php to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3564

Affected Products

Dayfox Blog

References · 5

• 🔥 https://exploit-db.com/exploits/6203 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3564 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44203 · Note
• http://securityreason.com/securityalert/4122 · Note
• http://securityfocus.com/bid/30538 · Note