CVE-2008-4319

fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string.

Score

CVSS 2.0 6.4 Medium

Status

Modified - cve@mitre.org

Published

2008-09-29

Last modified

2024-08-07

Weaknesses

CWE-287

Affected products

• Php Filemanager (Libra File Manager)

References

• http://www.securityfocus.com/archive/1/496742
• http://www.securityfocus.com/bid/31415
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45423
• https://www.exploit-db.com/exploits/6567