CVE

Id
34298  
CVE No.
CVE-2008-4181  
Status
Candidate  
Description
Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel PHP Register Globals is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) or absolute pathname in the fantasticopath parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.  
Phase
Assigned (20080923)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
375553 34298 CVE-2008-4181 MILW0RM:6461  View
375554 34298 CVE-2008-4181 URL:http://www.milw0rm.com/exploits/6461  View
375555 34298 CVE-2008-4181 CONFIRM:http://www.netenberg.com/forum/index.php?topic=6768.0  View
375556 34298 CVE-2008-4181 BID:31196  View
375557 34298 CVE-2008-4181 URL:http://www.securityfocus.com/bid/31196  View
375558 34298 CVE-2008-4181 SECUNIA:31863  View
375559 34298 CVE-2008-4181 URL:http://secunia.com/advisories/31863  View
375560 34298 CVE-2008-4181 SREASON:4301  View
375561 34298 CVE-2008-4181 URL:http://securityreason.com/securityalert/4301  View
375562 34298 CVE-2008-4181 XF:fantastico-xml-file-include(45147)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
50929 JVNDB-2008-006239 webCMS Portal Edition の index.php における SQL インジェクションの脆弱性 webCMS Portal Edition の index.php には、SQL インジェクションの脆弱性が存在します。 CVE-2008-4185 34298 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006239.html  View