PT-2008-5755 · Jmweb · Jmweb Mp3 Music Audio Search/Download Script

Sirgod · Published 2008-10-09 · Updated 2017-09-29 · CVE-2008-4522

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JMweb MP3 Music Audio Search and Download Script (affected versions not specified)

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to include and execute arbitrary local files. The attack can be performed by including a .. (dot dot) in the src parameter to API endpoints such as "listen.php" and "download.php".

Recommendations For JMweb MP3 Music Audio Search and Download Script, restrict access to the "listen.php" and "download.php" API endpoints to minimize the risk of exploitation. Avoid using the src parameter in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-4522

Affected Products

Jmweb Mp3 Music Audio Search/Download Script

References · 6

• 🔥 https://exploit-db.com/exploits/6669 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4522 · Security Note
• http://secunia.com/advisories/32141 · Vendor Advisory
• http://securityreason.com/securityalert/4386 · Note
• http://securityfocus.com/bid/31573 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45672 · Note