CVE-2007-1720 Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_na...
HighCVSS 7.5
EPSS 3.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sb-websoft addressbook | = 1.2 | No fix listed |
References
- 36572 vdb-entry
- 24697 third-party-advisory
- 23156 vdb-entry
- ADV-2007-1118 vdb-entry
- addressbook-addressbook-file-include(33243) vdb-entry
- 3582 exploit