A vulnerability was found in PHP Scripts Mall Opensource Classified Ads Script 3.2.2 (Programming Language Software). It has been rated as problematic. This issue affects an unknown part. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. The summary by CVE is:

PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory.

The bug was discovered 12/30/2018. The weakness was published 03/21/2019. The identification of this vulnerability is CVE-2019-7436 since 02/05/2019. The exploitation is known to be easy. The attack may be initiated remotely. A simple authentication is necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 81 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at 132066 and 132064.

Productinfo

Type

• Programming Language Software

Vendor

• PHP Scripts Mall

Name

• Opensource Classified Ads Script

Version

• 3.2.2

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion