CVE-2012-1617

EPSS 9.9%

Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/36917unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://archives.neohapsis.com/archives/bugtraq/2012-03/0024.html http://osclass.org/2012/03/05/osclass-2-3-6/http://secunia.com/advisories/48284 https://exchange.xforce.ibmcloud.com/vulnerabilities/73754 https://exchange.xforce.ibmcloud.com/vulnerabilities/73755 https://github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b https://github.com/osclass/OSClass/commit/a40b76695994442644e46e1b776d79660500566a https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-1 http://www.codseq.it/advisories/osclass_directory_traversal_vulnerability http://www.openwall.com/lists/oss-security/2012/04/02/1 http://www.openwall.com/lists/oss-security/2012/04/02/6 http://www.openwall.com/lists/oss-security/2012/04/03/1