CVE-2008-6960 download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database cr...
MediumCVSS 5.0
EPSS 7.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| x10media x10 automatic mp3 script | = 1.5.5 | No fix listed |
| x10media x10 automatic mp3 script | = 1.6 | No fix listed |
References
- 49797 exploit vdb-entry
- 32537 third-party-advisory vendor-advisory
- 32227 exploit vdb-entry
- ADV-2008-3062 vdb-entry vendor-advisory
- x10automaticmp3-url-info-disclosure(46489) vdb-entry
- 7074 exploit