CVE-2008-4319 fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary...
MediumCVSS 6.4
EPSS 2.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libra file manager php filemanager | <= 1.18 | No fix listed |
| libra file manager php filemanager | = 1.00 | No fix listed |
| libra file manager php filemanager | = 1.03 | No fix listed |
| libra file manager php filemanager | = 1.05 | No fix listed |
| libra file manager php filemanager | = 1.08 | No fix listed |
| libra file manager php filemanager | = 1.17 | No fix listed |
References
- 20080925 Fwd: Returned post for bugtraq@securityfocus.com exploit mailing-list
- 31415 exploit vdb-entry
- librafilemanager-fileadmin-security-bypass(45423) vdb-entry
- 6567 exploit