CVE-2008-6592 | BDVDB-2026-35905 Detail

Description#

thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/28801
http://www.securityfocus.com/archive/1/491064/100/0/threaded
http://www.osvdb.org/44674
http://secunia.com/advisories/29833
https://www.exploit-db.com/exploits/5452
https://exchange.xforce.ibmcloud.com/vulnerabilities/49851

Exploit#

https://www.exploit-db.com/exploits/5452

History#

Version 12009-04-03Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.