CVE-2007-0205
CVE-2007-0205
Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via ".." sequences in the (1) aj_skin and (2) skin_edit parameters. NOTE: this can be leveraged for file inclusion by creating a skin file in the lang directory, then referencing that file via the lang parameter to index.php, which passes a sanity check in livre_include.php.
Affected products
n/a · n/apublic PoCs found — 1
cve_referencewww.exploit-db.com/exploits/3103unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://acid-root.new.fr/poc/20070107.txthttp://osvdb.org/31708http://osvdb.org/31709http://securityreason.com/securityalert/2135https://exchange.xforce.ibmcloud.com/vulnerabilities/31397https://www.exploit-db.com/exploits/3103http://www.securityfocus.com/archive/1/456218/100/0/threadedhttp://www.securityfocus.com/bid/21926