CVE-2007-1138

Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directories, and read arbitrary files, via an absolute pathname in the nfolder parameter.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://osvdb.org/33138
http://securityreason.com/securityalert/2332	Exploit
http://www.securityfocus.com/archive/1/460913/100/0/threaded
http://www.securityfocus.com/bid/22669	Exploit
http://osvdb.org/33138
http://securityreason.com/securityalert/2332	Exploit
http://www.securityfocus.com/archive/1/460913/100/0/threaded
http://www.securityfocus.com/bid/22669	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:cromosoft:simple_plantilla_php:-:*:*:*:*:*:*:*

History

21 Nov 2024, 00:27

Type	Values Removed	Values Added
References	~~() http://osvdb.org/33138 -~~	() http://osvdb.org/33138 -
References	~~() http://securityreason.com/securityalert/2332 - Exploit~~	() http://securityreason.com/securityalert/2332 - Exploit
References	~~() http://www.securityfocus.com/archive/1/460913/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/460913/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/22669 - Exploit~~	() http://www.securityfocus.com/bid/22669 - Exploit

Information

Published : 2007-03-02 21:18

Updated : 2024-11-21 00:27

NVD link : CVE-2007-1138

Mitre link : CVE-2007-1138

CVE.ORG link : CVE-2007-1138

JSON object : View

Products Affected

cromosoft

simple_plantilla_php

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2007-1138", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-03-02T21:18:00.000", "references": [{"url": "http://osvdb.org/33138", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2332", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/460913/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/22669", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/33138", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityreason.com/securityalert/2332", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/460913/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/22669", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directories, and read arbitrary files, via an absolute pathname in the nfolder parameter."}, {"lang": "es", "value": "Vulnerabilidad de escalado de directorios de ruta absoluta en list_main_pages.php en Cromosoft Simple Plantilla PHP (SPP) permite a atacantes remotos listar directorios de su elecci\u00f3n, y leer ficheros de su elecci\u00f3n, mediante un nombre de ruta absoluto en el par\u00e1metro nfolder."}], "lastModified": "2024-11-21T00:27:36.670", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cromosoft:simple_plantilla_php:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84D9B336-C891-4030-90C6-C1E2F01390FE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}