|
CVE Reference: CVE-2008-7064
|
|
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.
|
|
Original Page at CVE MITRE:
CVE-2008-7064
|
|
Description:
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "\" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
|
|
CVE Status:
Candidate
|
|
References:
XF
http://xforce.iss.net/xforce/xfdb/46828
http://xforce.iss.net/xforce/xfdb/46823
SAID
Secunia Advisory: SA32823
OSVDB
50143
MILW0RM
http://www.milw0rm.com/exploits/7217
BID
32452
|
|
|
Return to the previous page.
|
