CVE-2008-0300 mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename th...
MediumCVSS 6.8
EPSS 2.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
mapFiler.php in Mapbender 2.4 to 2.4.4 allows remote attackers to execute arbitrary PHP code via PHP code sequences in the factor parameter, which are not properly handled when accessing a filename that contains those sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mapbender | = 2.4 | No fix listed |
| mapbender | = 2.4.1 | No fix listed |
| mapbender | = 2.4.2 | No fix listed |
| mapbender | = 2.4.3 | No fix listed |
| mapbender | = 2.4.4 | No fix listed |
References
- 29329 third-party-advisory
- www.redteam-pentesting.de exploit
- 28195 exploit patch vdb-entry
- mapbender-mapfiler-code-execution(41131) vdb-entry
- 5232 exploit