CVE-2008-5860 Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to create or....
MediumCVSS 5.1
EPSS 2.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to create or read arbitrary files via directory traversal sequences in the edit_file parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| constructr-cms | <= 3.02.5 | No fix listed |
| constructr-cms | = 3.00.0-alpha | No fix listed |
| constructr-cms | = 3.00.1-alpha | No fix listed |
| constructr-cms | = 3.00.2-alpha | No fix listed |
| constructr-cms | = 3.01.0-beta | No fix listed |
| constructr-cms | = 3.01.1-beta | No fix listed |
| constructr-cms | = 3.01.2-beta | No fix listed |
| constructr-cms | = 3.01.3-beta | No fix listed |
| constructr-cms | = 3.01.4-beta | No fix listed |
| constructr-cms | = 3.01.5-beta | No fix listed |
| constructr-cms | = 3.01.6-beta | No fix listed |
| constructr-cms | = 3.01.7-beta | No fix listed |
| constructr-cms | = 3.01.8-beta | No fix listed |
| constructr-cms | = 3.01.9-beta | No fix listed |
| constructr-cms | = 3.02.0 | No fix listed |
| constructr-cms | = 3.02.1 | No fix listed |
| constructr-cms | = 3.02.2 | No fix listed |
| constructr-cms | = 3.02.3 | No fix listed |
| constructr-cms | = 3.02.4 | No fix listed |