Unscored severity · published Sep 11, 2009
CVE-2008-7215
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified file[NewFile][name], file[NewFile][tmp_name], and file[NewFile][size] parameters in a FileUpload command, which are used to modify equivalent variables in $_FILES that are accessed when the is_uploaded_file check fails.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mambo · Mambo-foundation
through 4.6.3; 4.6.2 · source: NVD
MO
Mostlyce · Brilaps
through 2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-7215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-7215
Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
forum.mambo-foundation.org
http://forum.mambo-foundation.org/showthread.php?t=10158
Exploit
http://osvdb.org/42532
Vendor Advisory
http://secunia.com/advisories/28670
Exploit
http://www.bugreport.ir/index_33.htm
www.securityfocus.com
http://www.securityfocus.com/archive/1/487128/100/200/threaded
More from Mostlyce
–
CVE-2008-7214
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the…
–
CVE-2008-7213
Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and…
–
CVE-2008-7212
MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to…