NVD

Id
1796  
Name
CVE-2008-1856  
Description
plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file, which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory traversal sequences into the maps_type configuration setting, and then sending a request to maps_view.php, which causes plugins/maps/map.main.class.php to use the modified configuration.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-04-16  
Modified Date
2011-03-07  
Seq
2008-1856  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
11712 1796 CVE-2008-1856 http://sourceforge.net/project/shownotes.php?release_id=595725  View
11713 1796 CVE-2008-1856 5392  View
11714 1796 CVE-2008-1856 28654  View
11715 1796 CVE-2008-1856 ADV-2008-1136  View
11716 1796 CVE-2008-1856 linpha-mapmainclass-file-include(41676)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
49045 JVNDB-2008-004355 LinPHA の plugins/maps/db_handler.php におけるディレクトリトラバーサル攻撃を実行される脆弱性 LinPHA の plugins/maps/db_handler.php は、設定ファイルの変更操作に対して認証を必要としないため、ディレクトリトラバーサル攻撃を実行される、および任意のローカルファイルを実行される脆弱性が存在します。 CVE-2008-1856 31969 CVE-2008-1856 1796 5.1 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-004355.html 2008-04-16 2012-09-25 View