CVE-2008-6612

Published: Apr 6, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.

Affected (1)

Products: Abweb: Minimal Ablog

Abweb

1 product

Minimal Ablog

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Abweb Minimal Ablog	Version 0.4

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (10)

http://secunia.com/advisories/32886

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/32537

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2008/3291

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/46964

Source: cve@mitre.org

https://www.exploit-db.com/exploits/7306

Source: cve@mitre.org

http://secunia.com/advisories/32886