CVE-2012-4253
published 2012-08-13CVE-2012-4253: Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language…
PriorityP338medium4.3CVSS 2.0
AVNACMAuNCPINAN
EXPLOIT
EPSS
8.46%
94.3th percentile
Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files via a .. (dot dot) in the (3) config parameter to learn/cubemail/menu.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mysqldumper | mysqldumper | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
MySQLDumper 1.24.4 - 'install.php?language' Traversal Arbitrary File Access
exploitdb·2012-04-27
CVE-2012-4253 MySQLDumper 1.24.4 - 'install.php?language' Traversal Arbitrary File Access
MySQLDumper 1.24.4 - 'install.php?language' Traversal Arbitrary File Access
---
source: https://www.securityfocus.com/bid/53306/info
MySQLDumper is prone to multiple security vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and
Exploit-DB
MySQLDumper 1.24.4 - 'filemanagement.php?f' Traversal Arbitrary File Access
exploitdb·2012-04-27
CVE-2012-4253 MySQLDumper 1.24.4 - 'filemanagement.php?f' Traversal Arbitrary File Access
MySQLDumper 1.24.4 - 'filemanagement.php?f' Traversal Arbitrary File Access
---
source: https://www.securityfocus.com/bid/53306/info
MySQLDumper is prone to multiple security vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and
Nuclei
MySQLDumper 1.24.4 - Directory Traversal
nuclei·CVSS 4.3
CVE-2012-4253 [MEDIUM] MySQLDumper 1.24.4 - Directory Traversal
MySQLDumper 1.24.4 - Directory Traversal
Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files via a .. (dot dot) in the (3) config parameter to learn/cubemail/menu.php.
Template:
id: CVE-2012-4253
info:
name: MySQLDumper 1.24.4 - Directory Traversal
author: daffainfo
severity: medium
description: Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary loc
http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.htmlhttp://www.osvdb.org/81609http://www.osvdb.org/81615http://www.securityfocus.com/bid/53306https://exchange.xforce.ibmcloud.com/vulnerabilities/75283https://exchange.xforce.ibmcloud.com/vulnerabilities/75286http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.htmlhttp://www.osvdb.org/81609http://www.osvdb.org/81615http://www.securityfocus.com/bid/53306https://exchange.xforce.ibmcloud.com/vulnerabilities/75283https://exchange.xforce.ibmcloud.com/vulnerabilities/75286
2012-08-13
Published