Strix
26.1K

CVE-2008-5677

UnknownEPSS 4.13%

Last modified

CVE-2008-5677 is a vulnerability of currently unknown severity. Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.. EPSS estimates a 4.13% chance of exploitation in the next 30 days.

Description

Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.

Metrics

EPSS Probability
4.13%

89.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
KwalbumKwalbum<= 2.0.2
KwalbumKwalbum0.5.1
KwalbumKwalbum0.5.2
KwalbumKwalbum0.5.3
KwalbumKwalbum0.5.4
KwalbumKwalbum0.5.6
KwalbumKwalbum0.5.7
KwalbumKwalbum0.5.8
KwalbumKwalbum0.5.9
KwalbumKwalbum0.5.10
KwalbumKwalbum0.5.11
KwalbumKwalbum0.5.12
KwalbumKwalbum0.6.0
KwalbumKwalbum0.6.1
KwalbumKwalbum0.6.4
KwalbumKwalbum0.6.5
KwalbumKwalbum0.6.6
KwalbumKwalbum0.6.7
KwalbumKwalbum0.6.8
KwalbumKwalbum0.6.9
KwalbumKwalbum0.6.10
KwalbumKwalbum0.6.11
KwalbumKwalbum0.6.12
KwalbumKwalbum0.6.13
KwalbumKwalbum0.6.14
KwalbumKwalbum0.6.15
KwalbumKwalbum0.6.16
KwalbumKwalbum0.7.0
KwalbumKwalbum0.7.1
KwalbumKwalbum0.8.0
KwalbumKwalbum0.9.0
KwalbumKwalbum0.9.1
KwalbumKwalbum0.9.2
KwalbumKwalbum0.9.3
KwalbumKwalbum0.9.4
KwalbumKwalbum1.0
KwalbumKwalbum2.0
KwalbumKwalbum2.0.1
KwalbumKwalbum2.0.4

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2008-5677?
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.
How severe is CVE-2008-5677?
Severity scoring for CVE-2008-5677 is pending analysis. The EPSS model estimates a 4.13% probability of exploitation in the next 30 days.
How do I fix CVE-2008-5677?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2008-5677?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST