CVE-2008-5965 Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to check for the existence of arbitrary files via a .. (dot dot)...
MediumCVSS 5.0
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to check for the existence of arbitrary files via a .. (dot dot) in the page parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lokicms | <= 0.3.4 | No fix listed |
| lokicms | = 0.1.0 | No fix listed |
| lokicms | = 0.1.0rc1 | No fix listed |
| lokicms | = 0.2.0 | No fix listed |
| lokicms | = 0.3.0 | No fix listed |
| lokicms | = 0.3.1b1 | No fix listed |
| lokicms | = 0.3.1b2 | No fix listed |
| lokicms | = 0.3.2b1 | No fix listed |
| lokicms | = 0.3.3 | No fix listed |
References
- 30472 third-party-advisory
- 31730 exploit vdb-entry
- ADV-2008-2798 vdb-entry
- lokicms-index-directory-traversal(45822) vdb-entry
- 6737 exploit