critical9.0Public exploit code
CVE-2007-3312
Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary lo…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Jasmine CMS 1.0 - SQL Injection / Remote Code Execution2007-06-19 · webapps · php · Verified
Impact
Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary local files a .. (dot dot) in the u parameter. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Efstratios Geroulis | Jasmine Cms | Version 1.0 |
References
- NVD record
- CVE.org record
- http://osvdb.org/37067
- http://secunia.com/advisories/25737
- http://www.securityfocus.com/bid/24546
- http://www.vupen.com/english/advisories/2007/2264
- https://www.exploit-db.com/exploits/4081
- http://osvdb.org/37067
- http://secunia.com/advisories/25737
- http://www.securityfocus.com/bid/24546
- http://www.vupen.com/english/advisories/2007/2264
- https://www.exploit-db.com/exploits/4081