CVE

Id
29961  
CVE No.
CVE-2007-6604  
Status
Candidate  
Description
Multiple directory traversal vulnerabilities in index.php in XCMS 1.82 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the s parameter to the admin page or (2) the pg parameter to an arbitrary module, as demonstrated by reading a password hash in a .dtb file under dati/membri/ or by executing embedded PHP code in images under uploads/avatar/.  
Phase
Assigned (20071231)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
316978 29961 CVE-2007-6604 MILW0RM:4802  View
316979 29961 CVE-2007-6604 URL:http://www.milw0rm.com/exploits/4802  View
316980 29961 CVE-2007-6604 BID:27060  View
316981 29961 CVE-2007-6604 URL:http://www.securityfocus.com/bid/27060  View
316982 29961 CVE-2007-6604 OSVDB:40276  View
316983 29961 CVE-2007-6604 URL:http://osvdb.org/40276  View
316984 29961 CVE-2007-6604 SECUNIA:28256  View
316985 29961 CVE-2007-6604 URL:http://secunia.com/advisories/28256  View
316986 29961 CVE-2007-6604 XF:xcms-index-file-include(39281)  View
316987 29961 CVE-2007-6604 URL:http://xforce.iss.net/xforce/xfdb/39281  View
316988 29961 CVE-2007-6604 XF:xcms-index-information-disclosure(39282)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
56093 JVNDB-2007-004785 OpenBiblio における設定情報を取得される脆弱性 OpenBiblio には、設定情報を取得される脆弱性が存在します。 CVE-2007-6606 29961 5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-004785.html  View