CVE-2007-6378 Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the filename parameter.
HighCVSS 7.5
EPSS 3.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the filename parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| badblue | <= 2.72b | No fix listed |
References
- aluigi.altervista.org exploit
- aluigi.org
- 42417 vdb-entry
- 28031 third-party-advisory
- 3448 third-party-advisory
- 20071210 Multiple vulnerabilities in BadBlue 2.72b mailing-list
- 26803 exploit vdb-entry
- ADV-2007-4160 vdb-entry