PT-2008-5256 · Cmme · Content Management Made Easy

Sirgod · Published 2008-09-04 · Updated 2017-09-29 · CVE-2008-3926

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Content Management Made Easy (CMME) version 1.12

Description The issue allows remote attackers to read arbitrary files or create arbitrary directories. This can be achieved by exploiting directory traversal vulnerabilities, specifically by using a .. (dot dot) in the env parameter. For file reading, this can be done in a weblog action to "index.php". For directory creation, this can be done in a login action to "admin.php".

Recommendations For Content Management Made Easy (CMME) version 1.12, consider restricting access to the env parameter in both the weblog action to "index.php" and the login action to "admin.php" to prevent directory traversal attacks. As a temporary workaround, restrict the use of the env parameter until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3926

Affected Products

Content Management Made Easy

References · 7

• 🔥 https://exploit-db.com/exploits/6313 · Exploit
• 🔥 http://securityfocus.com/bid/30854 · Exploit
• 🔥 http://secunia.com/advisories/31599 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3926 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44683 · Note
• http://securityreason.com/securityalert/4220 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44687 · Note