CVE-2008-4437
Bugzilla < 2.22.5 and 3.x < 3.0.5 - Path Traversal via XML Import Data Element
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4437. PoCs published by ilja van sprundel.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Bugzilla, allowing an attacker to read arbitrary local files by manipulating the 'data' field with relative path traversal sequences. The vulnerability stems from insufficient input sanitization in affected Bugzilla versions.
Description
Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is enabled, allows remote attackers to read arbitrary files via an XML file with a .. (dot dot) in the data element.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in Bugzilla, allowing an attacker to read arbitrary local files by manipulating the 'data' field with relative path traversal sequences. The vulnerability stems from insufficient input sanitization in affected Bugzilla versions.