Vulnerabilities > CVE-2007-0337 - Local File Include vulnerability in KGB

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
kgb
exploit available
NVD
Published: 2007-01-18
Updated: 2017-10-19

Summary

Directory traversal vulnerability in sesskglogadmin.php in KGB 1.9 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skinnn parameter, as demonstrated by invoking kg.php with a postek parameter containing PHP code, which is injected into a file in the kg directory, and then included by sesskglogadmin.php.

Vulnerable Configurations

Part Description Count
Application
Kgb
1

Exploit-Db

descriptionKGB <= 1.9 (sesskglogadmin.php) Local File Include Exploit. CVE-2007-0337. Webapps exploit for php platform
fileexploits/php/webapps/3134.php
idEDB-ID:3134
last seen2016-01-31
modified2007-01-15
platformphp
port
published2007-01-15
reporterKacper
sourcehttps://www.exploit-db.com/download/3134/
titleKGB <= 1.9 sesskglogadmin.php Local File Include Exploit
typewebapps

References