vendor:
CMS from Scratch
by:
Stack
7.5
CVSS
HIGH
Local Directory Traversal
22 (Path Traversal)
CWE
Product Name: CMS from Scratch
Affected Version From: 1.1.2003
Affected Version To: 1.1.2003
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
CMS from Scratch <= 1.1.3 (image.php) Local Directory Traversal Vulnerability
A vulnerability in CMS from Scratch version 1.1.3 (image.php) allows an attacker to traverse the local directory structure and access sensitive files. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing directory traversal characters (e.g. '../') to the vulnerable application. This will allow the attacker to access files outside of the web root directory. Additionally, an attacker can upload a malicious PHP file to the web server and execute it.
Mitigation:
The best way to mitigate this vulnerability is to ensure that the application is not vulnerable to directory traversal attacks. This can be done by validating user input and sanitizing it before it is used in file system operations.
