Drake CMS 0.3.7/0.3.7 Beta 404.php d_private path traversal

Summaryinfo

A vulnerability classified as problematic was found in Drake CMS 0.3.7/0.3.7 Beta. This affects an unknown part of the file 404.php. The manipulation of the argument d_private results in path traversal. This vulnerability is cataloged as CVE-2007-1849. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Drake CMS 0.3.7/0.3.7 Beta (Content Management System). Affected is an unknown function of the file 404.php. The manipulation of the argument d_private with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute arbitrary local arbitrary files via a .. (dot dot) in the d_private parameter. NOTE: some of these details are obtained from third party information. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."

The weakness was shared 04/03/2007 by HACKERS PAL (Website). The advisory is available at securityfocus.com. This vulnerability is traded as CVE-2007-1849 since 04/03/2007. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:404.php it is possible to find vulnerable targets with Google Hacking.

The vulnerability is also documented in the databases at X-Force (33331), Exploit-DB (29805) and SecurityFocus (BID 23215†). The entries VDB-35995 and VDB-35993 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Vendor

• Drake

Name

• CMS

Version

• 0.3.7
• 0.3.7 Beta

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion