CVE-2008-1117
Timbuktu Pro 8.6.5 - Path Traversal and Arbitrary File Write via Notes Feature
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2008-1117.
PoCs published by Metasploit, Core Security, titon, including Metasploit module exploits/windows/motorola/timbuktu_fileupload.
AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in Timbuktu Pro for Windows 8.6.5, allowing arbitrary file upload and remote code execution by sending a malicious payload to the target service on port 407.
Description
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
Exploits (4)
This Metasploit module exploits a directory traversal vulnerability in Timbuktu Pro for Windows 8.6.5, allowing arbitrary file upload and remote code execution by sending a malicious payload to the target service on port 407.
This PoC exploits a path traversal vulnerability in Timbuktu Pro to upload arbitrary files to a remote system and forge log entries. It uses a sequence of crafted packets to bypass filters and achieve remote file write.
This exploit leverages a directory traversal vulnerability in Timbuktu Pro to arbitrarily delete or create files on the target system. It sends a series of crafted packets to manipulate file operations without authentication.
This Metasploit module exploits a directory traversal vulnerability in Timbuktu Pro for Windows 8.6.5, allowing arbitrary file upload and remote code execution via a crafted payload.