← back
CVE-2007-0620

CVE-2007-0620

EPSS 3.5%
download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/3203unverifiedexploitdbwww.exploit-db.com/exploits/29530unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://osvdb.org/33001http://secunia.com/advisories/23947http://securityreason.com/securityalert/2197https://exchange.xforce.ibmcloud.com/vulnerabilities/31915http://www.securityfocus.com/archive/1/458231/100/0/threadedhttp://www.securityfocus.com/bid/22265http://www.vupen.com/english/advisories/2007/0383