cbcvebase.
CVE-2008-5677
published 2008-12-19

CVE-2008-5677: Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with…

PriorityP337high7.1CVSS 2.0
AVNACHAuSCCICAC
EXPLOIT
EPSS
4.13%
89.5th percentile
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.

Affected

39 ranges· showing 25
VendorProductVersion rangeFixed in
kwalbumkwalbum<= 2.0.2—
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
kwalbumkwalbum——
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.