CVE

Id
23562  
CVE No.
CVE-2007-0205  
Status
Candidate  
Description
Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via ".." sequences in the (1) aj_skin and (2) skin_edit parameters. NOTE: this can be leveraged for file inclusion by creating a skin file in the lang directory, then referencing that file via the lang parameter to index.php, which passes a sanity check in livre_include.php.  
Phase
Assigned (20070111)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
228197 23562 CVE-2007-0205 BUGTRAQ:20070107 @lex Guestbook <= 4.0.2 Remote Command Execution Exploit  View
228198 23562 CVE-2007-0205 URL:http://www.securityfocus.com/archive/1/archive/1/456218/100/0/threaded  View
228199 23562 CVE-2007-0205 MISC:http://acid-root.new.fr/poc/20070107.txt  View
228200 23562 CVE-2007-0205 MILW0RM:3103  View
228201 23562 CVE-2007-0205 URL:http://milw0rm.com/exploits/3103  View
228202 23562 CVE-2007-0205 BID:21926  View
228203 23562 CVE-2007-0205 URL:http://www.securityfocus.com/bid/21926  View
228204 23562 CVE-2007-0205 OSVDB:31708  View
228205 23562 CVE-2007-0205 URL:http://osvdb.org/31708  View
228206 23562 CVE-2007-0205 OSVDB:31709  View
228207 23562 CVE-2007-0205 URL:http://osvdb.org/31709  View
228208 23562 CVE-2007-0205 SREASON:2135  View
228209 23562 CVE-2007-0205 URL:http://securityreason.com/securityalert/2135  View
228210 23562 CVE-2007-0205 XF:@lexguestbook-livreinclude-file-include(31397)  View

Related JVN