PT-2009-2559 · Pligg · Pligg

James Bercegay · Published 2009-08-26 · Updated 2018-10-11 · CVE-2008-7090

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pligg versions 9.9 and earlier

Description The issue allows remote attackers to determine the existence of arbitrary files or include arbitrary files via directory traversal vulnerabilities. This can be achieved by exploiting the $tb url variable in "trackback.php" or the template parameter in "settemplate.php" using a .. (dot dot) sequence.

Recommendations For Pligg versions 9.9 and earlier, as a temporary workaround, consider restricting access to the "trackback.php" and "settemplate.php" files until a patch is available. Avoid using the $tb url variable in "trackback.php" and the template parameter in "settemplate.php" with untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-7090

Affected Products

Pligg

References · 10

• 🔥 http://securityfocus.com/bid/30458 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00120-07312008 · Exploit
• 🔥 https://exploit-db.com/exploits/6173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7090 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44190 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44191 · Note
• http://osvdb.org/50188 · Note
• http://securityfocus.com/archive/1/494987/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7090 · Note
• http://osvdb.org/50187 · Note