← back
CVE-2010-2850

CVE-2010-2850

EPSS 2.7%
Directory traversal vulnerability in productionnu2/fileuploader.php in nuBuilder 10.04.20, and possibly other versions before 10.07.12, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dir parameter.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.org/1007-exploits/nubuilder-lfi.txtunverifiedexploitdbwww.exploit-db.com/exploits/14485unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://cross-site-scripting.blogspot.com/2010/07/nubuilder-100420-local-file-inclusion.htmlhttp://packetstormsecurity.org/1007-exploits/nubuilder-lfi.txthttp://secunia.com/advisories/40483https://exchange.xforce.ibmcloud.com/vulnerabilities/60138http://www.nubuilder.com/nubuilderwww/change.php?changelog_id=14c3d1ea2a9fabhttp://www.osvdb.org/66006http://www.securityfocus.com/bid/41404http://www.vupen.com/english/advisories/2010/1726