CVE-2007-5223

Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/25882
http://securityreason.com/securityalert/3191
http://osvdb.org/42344
http://osvdb.org/42342
http://osvdb.org/42343
http://www.vupen.com/english/advisories/2007/3344
http://www.securityfocus.com/archive/1/481206/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:alstrasoft:affiliate_network_pro:8.0:*:*:*:*:*:*:*

Information

Published : 2007-10-04 17:17

Updated : 2018-10-15 14:41

NVD link : CVE-2007-5223

Mitre link : CVE-2007-5223

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

alstrasoft

affiliate_network_pro

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/25882", "name": "25882", "tags": [], "refsource": "BID"}, {"url": "http://securityreason.com/securityalert/3191", "name": "3191", "tags": [], "refsource": "SREASON"}, {"url": "http://osvdb.org/42344", "name": "42344", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/42342", "name": "42342", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/42343", "name": "42343", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/3344", "name": "ADV-2007-3344", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/481206/100/0/threaded", "name": "20070929 Affiliate Network Pro Multiple Input Validation and Local file inclusion", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-5223", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-10-05T00:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:alstrasoft:affiliate_network_pro:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-15T21:41Z"}