JVNDB-2009-000064

Directory traversal vulnerability in multiple phpspot products

Multiple products provided by phpspot contain a directory traversal vulnerablility.

Multiple products (BBS Software etc.) provided by phpspot contain a directory traversal vulnerablility.

Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 5.0 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: None
• Availability Impact: None

phpspot

• PHP_RSS_Builder
• PHP&CSS BBS
• PHP image capture BBS
• PHP BBS
• PHP BBS CE
• webshot

A remote attacker could view files on the server where the product is installed. This could lead to disclosure of contents.

[Update the software]
Update to latest version according to the information provided by developer.

phpspot

• phpspot : September 2009 - PHP script vulnerabilities (Japanese)

1. Path Traversal(CWE-22) [IPA Evaluation]

1. CVE-2009-3284

1. JVN : JVN#65914253
2. National Vulnerability Database (NVD) : CVE-2009-3284
3. Secunia Advisory : SA36783

[2009/09/18]
  Web page published