Login Request a demo
Unscored severity · published Apr 3, 2009
CVE-2008-6592
thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via…
–
CVSS
2.9%
EPSS
No
On KEV
Description
thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lightneasy · Lightneasy
1.2.2 · source: NVD
SQ
Sqlite · Sqlite
1.2.2 · source: NVD
Affected product
LI
Lightneasy
Lightneasy
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6592
Vendor Advisory
http://secunia.com/advisories/29833
Exploit
http://www.osvdb.org/44674
www.securityfocus.com
http://www.securityfocus.com/archive/1/491064/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/28801
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/49851
www.exploit-db.com
https://www.exploit-db.com/exploits/5452
More from Lightneasy
–
CVE-2011-3978
Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1)…
–
CVE-2010-4753
Cross-site scripting (XSS) vulnerability in LightNEasy.php in LightNEasy 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, which is not…
–
CVE-2010-4752
SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page…
–
CVE-2010-4751
SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the…
–
CVE-2010-3485
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different…