CVE-2007-1158 Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
MediumCVSS 5.0
EPSS 4.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in index.php in the Pagesetter 6.2.0 through 6.3.0 beta 5 module for PostNuke allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postnuke software foundation pagesetter | = 6.2 | No fix listed |
| postnuke software foundation pagesetter | = 6.3.0-beta_5 | No fix listed |
References
- 20070226 SEC Consult SA-20070226-0 :: File Disclosure in mailing-list
- 20070227 Re:SEC Consult SA-20070226-0 :: File Disclosure mailing-list
- 33781 vdb-entry
- 24299 patch third-party-advisory vendor-advisory
- 2336 third-party-advisory
- www.elfisk.dk
- 20070226 SEC Consult SA-20070226-0 :: File Disclosure in Pagesetter for PostNuke mailing-list
- 22733 exploit vdb-entry
- ADV-2007-0758 vdb-entry
- pagesetter-index-directory-traversal(32695) vdb-entry