PT-2008-2237 · Xoops · Xoops

Alexandr Polyakov

+1

·

CVE-2008-0612

·

Published

2008-02-06

·

Updated

2018-10-15

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions XOOPS version 2.0.18
Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the lang parameter of the htdocs/install/index.php file.
Recommendations For XOOPS version 2.0.18, consider restricting access to the htdocs/install/index.php file until a patch is available, and avoid using the lang parameter with untrusted input.

Exploit

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0612

Affected Products

Xoops