CVE-2008-5771

Directory traversal vulnerability in test.php in PHP Weather 2.2.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/33098	Vendor Advisory
http://securityreason.com/securityalert/4826
http://www.securityfocus.com/bid/32820	Exploit
https://www.exploit-db.com/exploits/7451
http://secunia.com/advisories/33098	Vendor Advisory
http://securityreason.com/securityalert/4826
http://www.securityfocus.com/bid/32820	Exploit
https://www.exploit-db.com/exploits/7451

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpweather:phpweather:2.2.2:*:*:*:*:*:*:*

History

No history.

Information

Published : 2008-12-30 20:30

Updated : 2025-04-09 00:30

NVD link : CVE-2008-5771

Mitre link : CVE-2008-5771

CVE.ORG link : CVE-2008-5771

JSON object : View

Products Affected

phpweather

phpweather

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2008-5771", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-12-30T20:30:01.767", "references": [{"url": "http://secunia.com/advisories/33098", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/4826", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/32820", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/7451", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/33098", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityreason.com/securityalert/4826", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/32820", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/7451", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in test.php in PHP Weather 2.2.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en test.php en PHP Weather v2.2.2 permite a atacantes remotos incluir y ejecutar ficheros locales de su elecci\u00f3n a trav\u00e9s de secuencias de escalado de directorios en el par\u00e1metro language."}], "lastModified": "2025-04-09T00:30:58.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpweather:phpweather:2.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41D7C141-9043-4349-B4FF-167D492F4838"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}