medium6.4Public exploit code
CVE-2005-3927
Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GuppY 4.5 - 'nwlmail.php?lng' Traversal Arbitrary File Access2005-11-28 · webapps · php · Verified
- GuppY 4.5 - 'dbbatch.php?lng' Traversal Arbitrary File Access2005-11-28 · webapps · php · Verified
- GuppY 4.5 - 'archbatch.php?lng' Traversal Arbitrary File Access2005-11-28 · webapps · php · Verified
- GuppY 4.5 - 'editorTypetool.php?meskin' Traversal Arbitrary File Access2005-11-28 · webapps · php · Verified
Impact
Multiple directory traversal vulnerabilities in GuppY 4.5.9 and earlier allow remote attackers to read and include arbitrary files via (1) the meskin parameter to admin/editorTypetool.php, or the lng parameter to the in admin/inc scripts (2) archbatch.php, (3) dbbatch.php, and (4) nwlmail.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Guppy | Guppy | Versions 4.5, 4.5.3, 4.5.3a, 4.5.4, 4.5.9 |
References
- NVD record
- CVE.org record
- http://rgod.altervista.org/guppy459_xpl.html
- http://secunia.com/advisories/17790
- http://securityreason.com/securityalert/212
- http://securitytracker.com/id?1015279
- http://www.securityfocus.com/archive/1/417899/100/0/threaded
- http://www.securityfocus.com/bid/15610
- http://www.vupen.com/english/advisories/2005/2635
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23319
- http://rgod.altervista.org/guppy459_xpl.html
- http://secunia.com/advisories/17790
- http://securityreason.com/securityalert/212
- http://securitytracker.com/id?1015279
- http://www.securityfocus.com/archive/1/417899/100/0/threaded
- http://www.securityfocus.com/bid/15610
- http://www.vupen.com/english/advisories/2005/2635
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23319