CVE

Id
29202  
CVE No.
CVE-2007-5845  
Status
Candidate  
Description
Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: this can be leveraged to bypass authentication and upload arbitrary files by including admin/inc/upload.inc and specifying certain multipart/form-data input for admin/inc/upload.inc.  
Phase
Assigned (20071106)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
306309 29202 CVE-2007-5845 MILW0RM:3221  View
306310 29202 CVE-2007-5845 URL:http://www.milw0rm.com/exploits/3221  View
306311 29202 CVE-2007-5845 MILW0RM:4602  View
306312 29202 CVE-2007-5845 URL:http://www.milw0rm.com/exploits/4602  View
306313 29202 CVE-2007-5845 MISC:http://retrogod.altervista.org/guppy_4516_cmd.html  View
306314 29202 CVE-2007-5845 OSVDB:38492  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
52352 JVNDB-2007-001042 Apple Mac OS X の CFURLWriteDataAndPropertiesToResource API における情報漏えいの脆弱性 Apple Mac OS X の Core Foundation には、CFURLWriteDataAndPropertiesToResource API において、安全ではないアクセス権のファイルが作成される競合状態の脆弱性が存在します。 CVE-2007-5847 29202 6.6 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001042.html  View