CVE-2007-4820

Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files, and possibly execute local PHP scripts, via the nmf parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/39017
http://www.securityfocus.com/bid/25605	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/36533
https://www.exploit-db.com/exploits/4380
http://osvdb.org/39017
http://www.securityfocus.com/bid/25605	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/36533
https://www.exploit-db.com/exploits/4380

Configurations

Configuration 1 (hide)

cpe:2.3:a:sisfo_kampus:sisfo_kampus:2006:*:*:*:*:*:*:*

History

21 Nov 2024, 00:36

Type	Values Removed	Values Added
References	~~() http://osvdb.org/39017 -~~	() http://osvdb.org/39017 -
References	~~() http://www.securityfocus.com/bid/25605 - Exploit~~	() http://www.securityfocus.com/bid/25605 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/36533 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/36533 -
References	~~() https://www.exploit-db.com/exploits/4380 -~~	() https://www.exploit-db.com/exploits/4380 -

Information

Published : 2007-09-11 19:17

Updated : 2024-11-21 00:36

NVD link : CVE-2007-4820

Mitre link : CVE-2007-4820

CVE.ORG link : CVE-2007-4820

JSON object : View

Products Affected

sisfo_kampus

sisfo_kampus

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2007-4820", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-09-11T19:17:00.000", "references": [{"url": "http://osvdb.org/39017", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/25605", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36533", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/4380", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/39017", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/25605", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36533", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/4380", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files, and possibly execute local PHP scripts, via the nmf parameter."}, {"lang": "es", "value": "Vulnerabilidad de navegaci\u00f3n de ruta absoluta en blanko.preview.php de Sisfo Kampus 2006 permite a atacantes remotos leer archivos locales de su elecci\u00f3n, y posiblemente ejecutar secuencias de comandos PHP locales, mediante el par\u00e1metro nmf."}], "lastModified": "2024-11-21T00:36:31.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sisfo_kampus:sisfo_kampus:2006:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEAC86AF-9D23-4545-B3EF-0D7670B212B2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}