CVE-2008-0231 Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme web...
HighCVSS 7.5
EPSS 2.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via ".." sequences in the page parameter. NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tuned studios classic theme | All versions | No fix listed |
| tuned studios endless | All versions | No fix listed |
| tuned studios freeze theme | All versions | No fix listed |
| tuned studios lonely maple | All versions | No fix listed |
| tuned studios music theme | All versions | No fix listed |
| tuned studios orange cutout | All versions | No fix listed |
| tuned studios subwoofer | All versions | No fix listed |
References
- 3532 third-party-advisory
- 20080109 LFI in Tuned Studios Templates mailing-list
- 27196 exploit vdb-entry
- tunedstudiostemplates-index-file-include(39555) vdb-entry
- 4876 exploit