Vulnerability CVE-2013-5688

Vulnerability CVE-2013-5688

Published: 2013-11-05 Modified: 2013-11-07

Description:

Multiple directory traversal vulnerabilities in index.php in AjaXplorer 5.0.2 and earlier allow remote authenticated users to read arbitrary files via a ../%00 (dot dot backslash encoded null byte) in the file parameter in a (1) download or (2) get_content action, or (3) upload arbitrary files via a ../%00 (dot dot backslash encoded null byte) in the dir parameter in an upload action.

See advisories in our WLB2 database:

	Topic	Author	Date
High	AjaXplorer 5.0.2 Shell Upload & Traversal	Vikas Singhal	07.09.2013

Type:

CWE-22

(Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5.5/10	4.9/10	8/10

Exploit range	Attack complexity	Authentication
Remote	Low	Single time
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	None

Affected software
Ajaxplorer -> Ajaxplorer

References:

https://www.trustwave.com/spiderlabs/advisories/TWSL2013-027.txt

http://osvdb.org/97022

http://ajaxplorer.info/ajaxplorer-core-5-0-3/

Copyright 2024, cxsecurity.com