CVE-2008-0357

Directory traversal vulnerability in pages/upload.php in Galaxyscripts Mini File Host 1.2.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/28504	Vendor Advisory
http://www.securityfocus.com/bid/27327	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/39799
https://www.exploit-db.com/exploits/4930
http://secunia.com/advisories/28504	Vendor Advisory
http://www.securityfocus.com/bid/27327	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/39799
https://www.exploit-db.com/exploits/4930

Configurations

Configuration 1 (hide)

cpe:2.3:a:galaxyscripts:mini_file_host:*:*:*:*:*:*:*:*

History

21 Nov 2024, 00:41

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/28504 - Vendor Advisory~~	() http://secunia.com/advisories/28504 - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/27327 - Exploit~~	() http://www.securityfocus.com/bid/27327 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/39799 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/39799 -
References	~~() https://www.exploit-db.com/exploits/4930 -~~	() https://www.exploit-db.com/exploits/4930 -

Information

Published : 2008-01-18 22:00

Updated : 2024-11-21 00:41

NVD link : CVE-2008-0357

Mitre link : CVE-2008-0357

CVE.ORG link : CVE-2008-0357

JSON object : View

Products Affected

galaxyscripts

mini_file_host

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2008-0357", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2008-01-18T22:00:00.000", "references": [{"url": "http://secunia.com/advisories/28504", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/27327", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39799", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/4930", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28504", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/27327", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39799", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/4930", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in pages/upload.php in Galaxyscripts Mini File Host 1.2.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en pages/upload.php de Galaxyscripts Mini File Host 1.2.1 y versiones anteriores permite a atacantes remotos incluir y ejecutar ficheros locales de su elecci\u00f3n mediante secuencias de salto de directorio en el par\u00e1metro language."}], "lastModified": "2024-11-21T00:41:50.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:galaxyscripts:mini_file_host:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1D9F257-BE21-4E1E-BD84-29EE6AEC8152", "versionEndIncluding": "1.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}