CVE-2012-2227

EPSS 9.8%

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/18828unverified cve_referencewww.exploit-db.com/exploits/18828unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://archives.neohapsis.com/archives/bugtraq/2012-05/0011.html http://osvdb.org/81638 http://secunia.com/advisories/49026 https://exchange.xforce.ibmcloud.com/vulnerabilities/75330 https://www.htbridge.com/advisory/HTB23086 http://telechargements.pluxml.org/changelog http://www.exploit-db.com/exploits/18828 http://www.pluxml.org/article59/sortie-de-pluxml-5-1-6 http://www.securityfocus.com/bid/53348