vendor:
xeCMS
by:
p4imi0
7.5
CVSS
HIGH
Remote File Disclosure
22
CWE
Product Name: xeCMS
Affected Version From: 1.x.x
Affected Version To: 1.x.x
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
xeCMS 1.x.x Remote File Disclosure Vulnerability
This vulnerability allows an attacker to view arbitrary files on the server by exploiting the 'view.php' script. By manipulating the 'list' parameter, an attacker can traverse the directory structure and access sensitive files such as the '/etc/passwd' file.
Mitigation:
The vendor should release a patch to fix this vulnerability. In the meantime, restrict access to the 'view.php' script and sanitize user input to prevent directory traversal attacks.
