CVE-2008-5677

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-12-19 · updated 2026-06-16
Weakness: CWE-20

Description

Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.

Affected products

Kwalbum: through 2.0.2; 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.6, 0.5.7 (+32)

References

http://secunia.com/advisories/32145
http://securityreason.com/securityalert/4789
http://www.securityfocus.com/bid/31568
https://exchange.xforce.ibmcloud.com/vulnerabilities/45655
https://www.exploit-db.com/exploits/6664
http://secunia.com/advisories/32145
http://securityreason.com/securityalert/4789
http://www.securityfocus.com/bid/31568
https://exchange.xforce.ibmcloud.com/vulnerabilities/45655
https://www.exploit-db.com/exploits/6664

Get alerted when CVE-2008-5677 or the next vulnerability affects your stack