CVE-2008-0094

EPSS 3.2%

Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and (2) read arbitrary local files via a .. (dot dot) in the file parameter to assets/js/htcmime.php.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/30969unverified exploitdbwww.exploit-db.com/exploits/30968unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://modxcms.com/forums/index.php/topic%2C21290.0.html http://secunia.com/advisories/28220 http://securityreason.com/securityalert/3522 https://exchange.xforce.ibmcloud.com/vulnerabilities/39352 http://www.securityfocus.com/archive/1/485707/100/0/threaded http://www.securityfocus.com/bid/27096 http://www.securityfocus.com/bid/27097