CVE-2008-6423 Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the site_id parameter.
MediumCVSS 5.0
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the site_id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| i-apps passwiki | <= 0.9.16 | No fix listed |
| i-apps passwiki | = 0.9.3 | No fix listed |
| i-apps passwiki | = 0.9.5 | No fix listed |
| i-apps passwiki | = 0.9.6 | No fix listed |
| i-apps passwiki | = 0.9.7 | No fix listed |
| i-apps passwiki | = 0.9.8 | No fix listed |
| i-apps passwiki | = 0.9.9 | No fix listed |
| i-apps passwiki | = 0.9.10 | No fix listed |
| i-apps passwiki | = 0.9.11 | No fix listed |
| i-apps passwiki | = 0.9.12 | No fix listed |
| i-apps passwiki | = 0.9.13 | No fix listed |
| i-apps passwiki | = 0.9.14 | No fix listed |
| i-apps passwiki | = 0.9.15 | No fix listed |
| i-apps passwiki | = 0.9.15-beta | No fix listed |
| i-apps passwiki | = 0.9.15-beta2 | No fix listed |
| i-apps passwiki | = 0.9.15-rc1 | No fix listed |
| i-apps passwiki | = 0.9.16-beta1 | No fix listed |
| i-apps passwiki | = 0.9.16-beta2 | No fix listed |
| i-apps passwiki | = 0.9.16-beta3 | No fix listed |
| i-apps passwiki | = 0.9.16-rc1 | No fix listed |
| i-apps passwiki | = 0.9.16-rc2 | No fix listed |
References
- 45853 vdb-entry
- 30496 third-party-advisory vendor-advisory
- 29455 vdb-entry
- passwiki-passwiki-file-include(42768) vdb-entry
- 5704 exploit