CVE-2007-4756 Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via ".." (dot dot backslash) sequences in a filename...
MediumCVSS 6.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via ".." (dot dot backslash) sequences in a filename. NOTE: the ".." are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ghisler total commander | <= 7.01 | No fix listed |
References
- blog.hispasec.com
- 39838 vdb-entry
- 26734 third-party-advisory vendor-advisory
- 3106 third-party-advisory
- www.ghisler.com patch
- 20070906 [HISPASEC] 2K7SEPT6 Total Commander 7.01 Remote FTP Client Directory Traversal mailing-list
- 25581 exploit vdb-entry
- 1018662 vdb-entry
- ADV-2007-3102 vdb-entry
- totalcommander-ftp-directory-traversal(36486) vdb-entry
- totalcommander-ftp-weak-security(36487) vdb-entry