CVE-2007-6079 Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsOption[pagetype] parameter t...
MediumCVSS 6.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsOption[pagetype] parameter to the default URI for modules/news/. NOTE: this can be leveraged by using legitimate product functionality to upload a file that contains the code, then including that file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bcoos | = 1.0.10 | No fix listed |
References
- 26505 exploit vdb-entry
- ADV-2007-3962 vdb-entry
- bcoos-common-file-include(38592) vdb-entry
- 4637 exploit