CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 2CVE-2008-4483 – Crux Gallery 1.32 - 'theme' Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-4483
Directory traversal vulnerability in index.php in Crux Gallery 1.32 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter. Vulnerabilidad de salto de directorio en el archivo index.php en Crux Gallery 1.32 y versiones anteiores, cuando magic_quotes_gpc es deshabiitado, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos locales a través de .. (punto punto) en el parámetro theme. • https://www.exploit-db.com/exploits/6645 http://secunia.com/advisories/32058 http://securityreason.com/securityalert/4366 http://www.securityfocus.com/bid/31516 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 6%CPEs: 7EXPL: 1CVE-2008-4484 – Crux Gallery 1.32 - Insecure Cookie Handling
https://notcve.org/view.php?id=CVE-2008-4484
main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name parameter to "users," as demonstrated via index.php. main.php en Crux Gallery 1.32 y versiones anteriores, supone que el usuario es un administrador, si el nombre del parámetro no es "users", el cual permite a los atacantes remotos obtener acceso como administrador, estableciendo el nombre del parámetro a "users", como se demuestra a través de index.php. • https://www.exploit-db.com/exploits/6586 http://secunia.com/advisories/32058 http://securityreason.com/securityalert/4365 http://www.attrition.org/pipermail/vim/2008-October/002083.html http://www.securityfocus.com/archive/1/496763/100/0/threaded http://www.securityfocus.com/bid/31430 https://exchange.xforce.ibmcloud.com/vulnerabilities/45443 • CWE-264: Permissions, Privileges, and Access Controls •