CVE

Id
34884  
CVE No.
CVE-2008-4767  
Status
Candidate  
Description
Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality.  
Phase
Assigned (20081027)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
381878 34884 CVE-2008-4767 MISC:http://www.juniper.net/security/auto/vulnerabilities/vuln28919.html  View
381879 34884 CVE-2008-4767 BID:28919  View
381880 34884 CVE-2008-4767 URL:http://www.securityfocus.com/bid/28919  View
381881 34884 CVE-2008-4767 XF:downloadsplus-extension-file-upload(42007)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
48271 JVNDB-2008-003581 4xem VatCtrl Class などの VATDecoder.VatCtrl.1 ActiveX コントロールにおけるスタックベースのバッファオーバーフローの脆弱性 (1) 4xem VatCtrl Class (VATDecoder.dll)、(2) D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll)、および (3) Vivotek RTSP MPEG4 SP Control (RtspVapgDecoderNew.dll) などの VATDecoder.VatCtrl.1 ActiveX コントロールには、スタックベースのバッファオーバーフローの脆弱性が存在します。 CVE-2008-4771 34884 9.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-003581.html  View