CVE-2008-6960

download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://osvdb.org/49797	Exploit
http://secunia.com/advisories/32537	Vendor Advisory
http://www.securityfocus.com/bid/32227	Exploit
http://www.vupen.com/english/advisories/2008/3062	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/46489
https://www.exploit-db.com/exploits/7074

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:x10media:x10_automatic_mp3_script:1.5.5:::::::*
	cpe:2.3:a:x10media:x10_automatic_mp3_script:1.6:::::::*

History

No history.

Information

Published : 2009-08-12 10:30

Updated : 2023-12-10 10:51

NVD link : CVE-2008-6960

Mitre link : CVE-2008-6960

CVE.ORG link : CVE-2008-6960

JSON object : View

Products Affected

x10media

x10_automatic_mp3_script

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2008-6960", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-08-12T10:30:01.063", "references": [{"url": "http://osvdb.org/49797", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32537", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/32227", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/3062", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46489", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/7074", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php."}, {"lang": "es", "value": "download.php en X10media x10 Automatic Mp3 Search Engine Script v1.5.5 a la v1.6, permite a atacantes remotos la lectura de archivos de su elecci\u00f3n a trav\u00e9s del par\u00e1metro \"url\" codificado, como se demostr\u00f3 obteniendo las credenciales de la base de datos desde includes/constants.php."}], "lastModified": "2017-09-29T01:33:27.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:x10media:x10_automatic_mp3_script:1.5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D03C9233-19C5-40D0-A908-4591C9EDE6D6"}, {"criteria": "cpe:2.3:a:x10media:x10_automatic_mp3_script:1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "360D04A0-F42E-4DD5-9B91-1A44C59D4927"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}