CVE-2008-5752: Path Traversal
Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the bookid parameter. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable magic_quotes_gpc by setting magic_quotes_gpc = On in your php.ini to mitigate the directory traversal via the book_id parameter in the Page Flip Image Gallery plugin 0.2.2 and earlier.
PHP magic_quotes_gpc = On
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5752?
CVE-2008-5752 has a moderate severity as it allows remote attackers to read arbitrary files.
How do I fix CVE-2008-5752?
To fix CVE-2008-5752, upgrade the Page Flip Image Gallery plugin to version 0.2.3 or later.
Which versions of the Page Flip Image Gallery plugin are affected by CVE-2008-5752?
Versions 0.2.2 and earlier of the Page Flip Image Gallery plugin are affected by CVE-2008-5752.
What type of vulnerability is CVE-2008-5752?
CVE-2008-5752 is a directory traversal vulnerability.
What parameters are exploited in CVE-2008-5752?
CVE-2008-5752 is exploited via the book_id parameter.