CVE-2008-5204

Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter to (1) agb.php, (2) angemeldet.php, (3) anmelden.php, (4) charts.php, (5) external_vote.php, (6) guestbook.php, (7) impressum.php, (8) index.php, (9) rss-reader.php, (10) statistic.php, (11) teilnehmer.php, (12) topsites.php, (13) votecode.php, (14) voting.php, and (15) winner.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/29993	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/43463
https://www.exploit-db.com/exploits/5962

Configurations

Configuration 1 (hide)

cpe:2.3:a:poweraward:poweraward:1.1.0:rc1:*:*:*:*:*:*

History

No history.

Information

Published : 2008-11-21 17:30

Updated : 2024-02-04 17:33

NVD link : CVE-2008-5204

Mitre link : CVE-2008-5204

CVE.ORG link : CVE-2008-5204

JSON object : View

Products Affected

poweraward

poweraward

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2008-5204", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2008-11-21T17:30:00.703", "references": [{"url": "http://www.securityfocus.com/bid/29993", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43463", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/5962", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter to (1) agb.php, (2) angemeldet.php, (3) anmelden.php, (4) charts.php, (5) external_vote.php, (6) guestbook.php, (7) impressum.php, (8) index.php, (9) rss-reader.php, (10) statistic.php, (11) teilnehmer.php, (12) topsites.php, (13) votecode.php, (14) voting.php, and (15) winner.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en PowerAward v1.1.0 RC1, cuando register_globals est\u00e1 habilitado, permiten a atacantes remotos incluir y ejecutar archivos locales de su elecci\u00f3n a trav\u00e9s de secuencias de salto de directorio en el par\u00e1metro lang a (1) agb.php, (2) angemeldet.php, (3) anmelden.php, (4) charts.php, (5) external_vote.php, (6) guestbook.php, (7) impressum.php, (8) index.php, (9) rss-reader.php, (10) statistic.php, (11) teilnehmer.php, (12) topsites.php, (13) votecode.php, (14) voting.php, and (15) winner.php."}], "lastModified": "2017-09-29T01:32:31.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:poweraward:poweraward:1.1.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EECA0BDF-E2B7-43EB-B83F-DD3EADE6632E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}