20120307 OSClass directory traversal (leads to arbitrary file upload)mailing list
http://archives.neohapsis.com/archives/bugtraq/2012-03/0024.html CVE-2012-1617
OSClass 2.3.x - Directory Traversal / Arbitrary File Upload
Record summary
CVE-2012-1617 has a selected CVSS score of 6.4; EIP currently links 1 catalogued exploit.
Description
Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBOSClass 2.3.x - Directory Traversal / Arbitrary File UploadExploitDB exploitby Filippo CavallarinNot analyzed1 file
References
Showing 12 of 15osclass.orgConfirmation
http://osclass.org/2012/03/05/osclass-2-3-6 48284Third-party advisory
http://secunia.com/advisories/48284 codseq.it
http://www.codseq.it/advisories/osclass_directory_traversal_vulnerability [oss-security] 20120402 CVE request: OSClass directory traversal vulnerabilitymailing list
http://www.openwall.com/lists/oss-security/2012/04/02/1 [oss-security] 20120402 Re: CVE request: OSClass directory traversal vulnerabilitymailing list
http://www.openwall.com/lists/oss-security/2012/04/02/6 [oss-security] 20120403 Re: CVE request: OSClass directory traversal vulnerabilitymailing list
http://www.openwall.com/lists/oss-security/2012/04/03/1 [oss-security] 20120404 Re: CVE request: OSClass directory traversal vulnerabilitymailing list
http://www.openwall.com/lists/oss-security/2012/04/04/7 52336vdb entry
http://www.securityfocus.com/bid/52336 osclass-directory-traversal(73754)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/73754 osclass-file-upload(73755)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/73755 github.comConfirmation
https://github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b