vendor:
1024 CMS
by:
Dj7xpl
N/A
CVSS
MEDIUM
Remote File Disclosure
22
CWE
Product Name: 1024 CMS
Affected Version From: 0.7
Affected Version To: 0.7
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
Remote File Disclosure Vulnerability in 1024 CMS Version 0.7
The vulnerability allows an attacker to disclose sensitive files on the target system. By manipulating the 'item' parameter in the 'download.php' script, an attacker can traverse directories and access files outside the intended directory.
Mitigation:
The vendor should release a patch that validates user input and prevents directory traversal attacks. Additionally, access controls should be implemented to restrict access to sensitive files.
