CVEvulnerability
CVE-2008-6592
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-04-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-22
Description
thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).
Affected configurations
• lightneasy lightneasy 1.2.2
• sqlite sqlite 1.2.2
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://secunia.com/advisories/29833 Vendor Advisory
- http://www.osvdb.org/44674 Exploit
- http://www.securityfocus.com/archive/1/491064/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28801 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49851 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/5452 www.exploit-db.com
- http://secunia.com/advisories/29833 Vendor Advisory
- http://www.osvdb.org/44674 Exploit
- http://www.securityfocus.com/archive/1/491064/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28801 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49851 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/5452 www.exploit-db.com