mini-pub 0.1/0.1.1/0.1.2/0.3 sDir path traversal

Summaryinfo

A vulnerability was found in mini-pub 0.1/0.1.1/0.1.2/0.3 and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sDir results in path traversal. This vulnerability is known as CVE-2008-5883. Furthermore, an exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, was found in mini-pub 0.1/0.1.1/0.1.2/0.3. Affected is an unknown code. The manipulation of the argument sDir with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. CVE summarizes:

Absolute path traversal vulnerability in front-end/dir.php in mini-pub 0.3 and earlier allows remote attackers to list arbitrary directories via a full pathname in the sDir parameter.

The weakness was published 01/12/2009 by GoLd_M (Website). The advisory is shared for download at milw0rm.com. This vulnerability is traded as CVE-2008-5883 since 01/12/2009. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1006.

A public exploit has been developed by GoLd_M and been published even before and not after the advisory. The exploit is shared for download at exploit-db.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 92 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (45829), Exploit-DB (6734) and SecurityFocus (BID 31733†). Similar entry is available at VDB-46008. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• mini-pub

Version

• 0.1
• 0.1.1
• 0.1.2
• 0.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion