Low severity · published May 2, 2005
CVE-2005-0254
BibORB 1.3.2, and possibly earlier versions, does not properly enforce a restriction for uploading only PDF and PS files, which allows remote attackers to upload arbitrary files…
3.7
CVSS
1.7%
EPSS
No
On KEV
Description
BibORB 1.3.2, and possibly earlier versions, does not properly enforce a restriction for uploading only PDF and PS files, which allows remote attackers to upload arbitrary files that are presented to other users with PDF or PS icons, which may trick some users into downloading and executing those files.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Biborb · Guillaumegardey
1.3.2; 1.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0254
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0254
Exploit
http://marc.info/?l=bugtraq&m=110868948719773&w=2
Exploit
http://marc.info/?l=full-disclosure&m=110864983905770&w=2
Broken Link
http://www.securityfocus.com/bid/12583
More from Biborb
–
CVE-2005-0251
Cross-site scripting (XSS) vulnerability in bibindex.php for BibORB 1.3.2, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the…
–
CVE-2005-0252
SQL injection vulnerability in BibORB 1.3.2, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password
–
CVE-2005-0253
Directory traversal vulnerability in index.php for BibORB 1.3.2, and possibly earlier versions, allows remote attackers to delete arbitrary files via a Delete action and