CVE-2008-6490 function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the target filename in the target_file parameter. NOTE: this can be leveraged for c...
HighCVSS 7.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the target filename in the target_file parameter. NOTE: this can be leveraged for code execution by overwriting a PHP file, as demonstrated using function/upload_file.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flysforum flaber | <= 1.1 | No fix listed |
References
- ADV-2008-1163 vdb-entry vendor-advisory
- flaber-updatexml-code-execution(41715) vdb-entry
- 5407 exploit