CVE-2008-6592

thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/29833	Vendor Advisory
http://www.osvdb.org/44674	Exploit
http://www.securityfocus.com/archive/1/491064/100/0/threaded
http://www.securityfocus.com/bid/28801
https://exchange.xforce.ibmcloud.com/vulnerabilities/49851
https://www.exploit-db.com/exploits/5452

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:lightneasy:lightneasy:1.2.2::no_database:::::
	cpe:2.3:a:sqlite:sqlite:1.2.2:::::::*

History

No history.

Information

Published : 2009-04-03 18:30

Updated : 2024-02-28 11:21

NVD link : CVE-2008-6592

Mitre link : CVE-2008-6592

CVE.ORG link : CVE-2008-6592

JSON object : View

Products Affected

lightneasy

lightneasy

sqlite

sqlite

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2008-6592", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-04-03T18:30:00.377", "references": [{"url": "http://secunia.com/advisories/29833", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/44674", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/491064/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/28801", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49851", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/5452", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy \"no database\" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte)."}, {"lang": "es", "value": "thumbsup.php en Thumbs-Up v1.12, cuando se utiliza en LightNEasy \"no database\" (tambi\u00e9n conocido como flat) y SQLite v1.2.2 permite a atacantes remotos copiar, renombrar, y leer ficheros de modo arbitrario a trav\u00e9s de secuencias de salto de directorio en el par\u00e1metro \"image\" con un par\u00e1metro modificado cache_dir conteniendo un %00 (byte codificado nulo)."}], "lastModified": "2018-10-11T20:57:30.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lightneasy:lightneasy:1.2.2:*:no_database:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F76F72FB-D3CE-4229-93B1-FE0A021972B0"}, {"criteria": "cpe:2.3:a:sqlite:sqlite:1.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65EA4824-622E-4A2E-969F-05AF2C5B1F8C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}