CVE

Id
32789  
CVE No.
CVE-2008-2672  
Status
Candidate  
Description
Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) ewiki_id and (2) ewiki_action parameters to fragments/css.php, and possibly the (3) id parameter to the default URI. NOTE: the default URI is site-specific but often performs an include_once of ewiki.php.  
Phase
Assigned (20080611)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
354965 32789 CVE-2008-2672 BUGTRAQ:20080610 [web-app] ErfurtWiki <= R1.02b (css) Local File Inclusion Vulnerability  View
354966 32789 CVE-2008-2672 URL:http://www.securityfocus.com/archive/1/archive/1/493219/100/0/threaded  View
354967 32789 CVE-2008-2672 MILW0RM:5771  View
354968 32789 CVE-2008-2672 URL:http://www.milw0rm.com/exploits/5771  View
354969 32789 CVE-2008-2672 MISC:http://chroot.org/exploits/chroot_uu_007  View
354970 32789 CVE-2008-2672 BID:29628  View
354971 32789 CVE-2008-2672 URL:http://www.securityfocus.com/bid/29628  View
354972 32789 CVE-2008-2672 SREASON:3936  View
354973 32789 CVE-2008-2672 URL:http://securityreason.com/securityalert/3936  View
354974 32789 CVE-2008-2672 XF:erfurtwiki-css-file-include(42981)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
46811 JVNDB-2008-002121 Joomla! の iJoomla! News Portal (com_news_portal) コンポーネントにおける SQL インジェクションの脆弱性 Joomla! の iJoomla! News Portal (com_news_portal) コンポーネントに SQL インジェクションの脆弱性が存在します。 CVE-2008-2676 32789 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002121.html  View