CVE-2008-3415
published 2008-07-31CVE-2008-3415: Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary…
PriorityP343high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.94%
85.4th percentile
Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cmscout | cmscout | — | — |
| cmscout | cmscout | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-ww73-22h6-4w8c: Multiple directory traversal vulnerabilities in CMScout 2
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2008-6726 [HIGH] CWE-22 GHSA-ww73-22h6-4w8c: Multiple directory traversal vulnerabilities in CMScout 2
Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bit parameter to (1) admin.php and (2) index.php, different vectors than CVE-2008-3415.
GHSA
GHSA-x863-92xc-p6xw: Directory traversal vulnerability in common
ghsa_unreviewed·2022-05-02
CVE-2008-3415 [HIGH] CWE-22 GHSA-x863-92xc-p6xw: Directory traversal vulnerability in common
Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.
No detection rules found.
No writeups or analysis indexed.
http://secunia.com/advisories/31243http://securityreason.com/securityalert/4093http://www.cmscout.co.za/index.php?page=news&id=29http://www.securityfocus.com/bid/30385http://www.vupen.com/english/advisories/2008/2218/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/44017https://www.exploit-db.com/exploits/6142http://secunia.com/advisories/31243http://securityreason.com/securityalert/4093http://www.cmscout.co.za/index.php?page=news&id=29http://www.securityfocus.com/bid/30385http://www.vupen.com/english/advisories/2008/2218/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/44017https://www.exploit-db.com/exploits/6142
2008-07-31
Published