CVE

Id
35794  
CVE No.
CVE-2008-5677  
Status
Candidate  
Description
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.  
Phase
Assigned (20081218)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
393495 35794 CVE-2008-5677 MILW0RM:6664  View
393496 35794 CVE-2008-5677 URL:http://www.milw0rm.com/exploits/6664  View
393497 35794 CVE-2008-5677 BID:31568  View
393498 35794 CVE-2008-5677 URL:http://www.securityfocus.com/bid/31568  View
393499 35794 CVE-2008-5677 SECUNIA:32145  View
393500 35794 CVE-2008-5677 URL:http://secunia.com/advisories/32145  View
393501 35794 CVE-2008-5677 SREASON:4789  View
393502 35794 CVE-2008-5677 URL:http://securityreason.com/securityalert/4789  View
393503 35794 CVE-2008-5677 XF:kwalbum-file-upload(45655)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
47038 JVNDB-2008-002348 Opera における既存のサブスクリプションを閲覧され、任意の feed URL のサブスクリプションを強制される脆弱性 Opera には、feed プレビューの間、 "スクリプト化された URL" を遮断しないため、既存のサブスクリプションを閲覧され、任意の feed URL のサブスクリプションを強制される脆弱性が存在します。 CVE-2008-5681 35794 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002348.html  View