CVE-2007-4843 Directory traversal vulnerability in X-Diesel Unreal Commander 0.92 build 565 and 573 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a filename. NOTE: this can....
MediumCVSS 5.8
EPSS 3.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in X-Diesel Unreal Commander 0.92 build 565 and 573 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a filename. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| x-diesel unreal commander | = 0.92_build565 | No fix listed |
| x-diesel unreal commander | = 0.92_build573 | No fix listed |
References
- blog.hispasec.com exploit
- 39615 vdb-entry
- 26739 third-party-advisory
- 3125 third-party-advisory
- 20070906 [HISPASEC] 2K7SEPT6 X-Diesel Unreal Commander v0.92 (build 573) multiple FTP-based vulnerabilities mailing-list
- 25583 exploit vdb-entry