CVE-2008-5677 Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary co...
HighCVSS 7.1
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kwalbum | <= 2.0.2 | No fix listed |
| kwalbum | = 0.5.1 | No fix listed |
| kwalbum | = 0.5.2 | No fix listed |
| kwalbum | = 0.5.3 | No fix listed |
| kwalbum | = 0.5.4 | No fix listed |
| kwalbum | = 0.5.6 | No fix listed |
| kwalbum | = 0.5.7 | No fix listed |
| kwalbum | = 0.5.8 | No fix listed |
| kwalbum | = 0.5.9 | No fix listed |
| kwalbum | = 0.5.10 | No fix listed |
| kwalbum | = 0.5.11 | No fix listed |
| kwalbum | = 0.5.12 | No fix listed |
| kwalbum | = 0.6.0 | No fix listed |
| kwalbum | = 0.6.1 | No fix listed |
| kwalbum | = 0.6.4 | No fix listed |
| kwalbum | = 0.6.5 | No fix listed |
| kwalbum | = 0.6.6 | No fix listed |
| kwalbum | = 0.6.7 | No fix listed |
| kwalbum | = 0.6.8 | No fix listed |
| kwalbum | = 0.6.9 | No fix listed |
| kwalbum | = 0.6.10 | No fix listed |
| kwalbum | = 0.6.11 | No fix listed |
| kwalbum | = 0.6.12 | No fix listed |
| kwalbum | = 0.6.13 | No fix listed |
| kwalbum | = 0.6.14 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| kwalbum | = 0.6.15 | No fix listed |
| kwalbum | = 0.6.16 | No fix listed |
| kwalbum | = 0.7.0 | No fix listed |
| kwalbum | = 0.7.1 | No fix listed |
| kwalbum | = 0.8.0 | No fix listed |
| kwalbum | = 0.9.0 | No fix listed |
| kwalbum | = 0.9.1 | No fix listed |
| kwalbum | = 0.9.2 | No fix listed |
| kwalbum | = 0.9.3 | No fix listed |
| kwalbum | = 0.9.4 | No fix listed |
| kwalbum | = 1.0 | No fix listed |
| kwalbum | = 2.0 | No fix listed |
| kwalbum | = 2.0.1 | No fix listed |
| kwalbum | = 2.0.4 | No fix listed |
References
- 32145 third-party-advisory vendor-advisory
- 4789 third-party-advisory
- 31568 exploit vdb-entry
- kwalbum-file-upload(45655) vdb-entry
- 6664 exploit