CVE-2008-6884 Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfig...
MediumCVSS 6.8
EPSS 5.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple directory traversal vulnerabilities in XOOPS 2.3.1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter to (1) blocks.php and (2) main.php in xoops_lib/modules/protector/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xoops | = 2.3.1 | No fix listed |
References
- 20081208 [DSECRG-08-040] Multiple Local File Include Vulnerabilities in Xoops 2.3.x exploit mailing-list patch
- 50572 patch vdb-entry
- 50573 patch vdb-entry
- 33048 third-party-advisory vendor-advisory
- 32685 patch vdb-entry
- www.xoops.org patch vendor-advisory
- www.xoops.org patch vendor-advisory
- xoops-blocks-main-file-include(47153) vdb-entry
- 7380 exploit