CVE-2008-4319

fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/archive/1/496742	Exploit
http://www.securityfocus.com/bid/31415	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/45423
https://www.exploit-db.com/exploits/6567
http://www.securityfocus.com/archive/1/496742	Exploit
http://www.securityfocus.com/bid/31415	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/45423
https://www.exploit-db.com/exploits/6567

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:libra_file_manager:php_filemanager::::::::
	cpe:2.3:a:libra_file_manager:php_filemanager:1.00:::::::*
	cpe:2.3:a:libra_file_manager:php_filemanager:1.03:::::::*
	cpe:2.3:a:libra_file_manager:php_filemanager:1.05:::::::*
	cpe:2.3:a:libra_file_manager:php_filemanager:1.08:::::::*
	cpe:2.3:a:libra_file_manager:php_filemanager:1.17:::::::*

History

21 Nov 2024, 00:51

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/archive/1/496742 - Exploit~~	() http://www.securityfocus.com/archive/1/496742 - Exploit
References	~~() http://www.securityfocus.com/bid/31415 - Exploit~~	() http://www.securityfocus.com/bid/31415 - Exploit
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/45423 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/45423 -
References	~~() https://www.exploit-db.com/exploits/6567 -~~	() https://www.exploit-db.com/exploits/6567 -

Information

Published : 2008-09-29 19:25

Updated : 2024-11-21 00:51

NVD link : CVE-2008-4319

Mitre link : CVE-2008-4319

CVE.ORG link : CVE-2008-4319

JSON object : View

Products Affected

libra_file_manager

php_filemanager

CWE

CWE-287

Improper Authentication

{"id": "CVE-2008-4319", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2008-09-29T19:25:35.760", "references": [{"url": "http://www.securityfocus.com/archive/1/496742", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/31415", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45423", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/6567", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/496742", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/31415", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45423", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/6567", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string."}, {"lang": "es", "value": "El m\u00f3dulo fileadmin.php en Libra File Manager (tambi\u00e9n conocido como Libra PHP File Manager) v1.18 y anteriores permite a atacantes remotos evitar la autenticaci\u00f3n, leer ficheros arbitrarios, modificar ficheros arbitrarios y listar el contenido de directorios arbitrarios, al insertar ciertos par\u00e1metros \"user\" e \"isadmin\" en la cadena de consulta."}], "lastModified": "2024-11-21T00:51:22.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93AF7428-B3B2-4962-A3EC-7417FCF22B60", "versionEndIncluding": "1.18"}, {"criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C83A5C9-A836-4B7F-A0E0-4C354525A08A"}, {"criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB9543DA-0F76-4438-BE61-51D42412A813"}, {"criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A152A89-1E0A-47A3-AABD-C5FBC4869EDD"}, {"criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.08:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D225985-9697-4704-AA54-1A9B9D7B8988"}, {"criteria": "cpe:2.3:a:libra_file_manager:php_filemanager:1.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DFE7EF9-9374-4DF3-9851-E830D424A7AF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}