CVE-2008-6591

LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to (1) index.php and (2) LightNEasy.php.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/44678
http://osvdb.org/44679
http://secunia.com/advisories/29833	Vendor Advisory
http://www.securityfocus.com/archive/1/491064/100/0/threaded
http://www.securityfocus.com/bid/28839	Exploit
http://osvdb.org/44678
http://osvdb.org/44679
http://secunia.com/advisories/29833	Vendor Advisory
http://www.securityfocus.com/archive/1/491064/100/0/threaded
http://www.securityfocus.com/bid/28839	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:lightneasy:lightneasy:1.2.2::no_database:::::
	cpe:2.3:a:lightneasy:lightneasy:1.2.2::sqlite:::::

History

21 Nov 2024, 00:56

Type	Values Removed	Values Added
References	~~() http://osvdb.org/44678 -~~	() http://osvdb.org/44678 -
References	~~() http://osvdb.org/44679 -~~	() http://osvdb.org/44679 -
References	~~() http://secunia.com/advisories/29833 - Vendor Advisory~~	() http://secunia.com/advisories/29833 - Vendor Advisory
References	~~() http://www.securityfocus.com/archive/1/491064/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/491064/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/28839 - Exploit~~	() http://www.securityfocus.com/bid/28839 - Exploit

Information

Published : 2009-04-03 18:30

Updated : 2024-11-21 00:56

NVD link : CVE-2008-6591

Mitre link : CVE-2008-6591

CVE.ORG link : CVE-2008-6591

JSON object : View

Products Affected

lightneasy

lightneasy

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2008-6591", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-04-03T18:30:00.360", "references": [{"url": "http://osvdb.org/44678", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/44679", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/29833", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/491064/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/28839", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/44678", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://osvdb.org/44679", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/29833", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/491064/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/28839", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "LightNEasy \"no database\" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to (1) index.php and (2) LightNEasy.php."}, {"lang": "es", "value": "LightNEasy \"no database\" (tambi\u00e9n conocido flat) v1.2.2, y posiblemente SQLite v1.2.2, permite a atacantes remotos crear ficheros a su elecci\u00f3n a trav\u00e9s del par\u00e1metro \"page\" a (1) index.php y (2) LightNEasy.php."}], "lastModified": "2024-11-21T00:56:56.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lightneasy:lightneasy:1.2.2:*:no_database:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F76F72FB-D3CE-4229-93B1-FE0A021972B0"}, {"criteria": "cpe:2.3:a:lightneasy:lightneasy:1.2.2:*:sqlite:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE0BB79F-7442-4C26-8268-33E259324DF3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}