PT-2008-4965 · Mozilo · Mozilocms

Ams · Published 2008-08-11 · Updated 2017-09-29 · CVE-2008-3589

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions moziloCMS version 1.10.1

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the download.php file when magic quotes gpc is disabled. This is achieved by using a .. (dot dot) in the cat parameter.

Recommendations For moziloCMS version 1.10.1, consider disabling the download.php file or restricting access to it until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue. Avoid using the cat parameter in the download.php file until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3589

Affected Products

Mozilocms

References · 6

• 🔥 https://exploit-db.com/exploits/6194 · Exploit
• http://secunia.com/advisories/31327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3589 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44162 · Note
• http://securityreason.com/securityalert/4136 · Note
• http://securityfocus.com/bid/30526 · Note