critical9.0Public exploit code
CVE-2007-1455
Multiple absolute path traversal vulnerabilities in Fantastico, as used with cPanel 10.x, allow remote authenticated users to include and execute arbitrary loc…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- cPanel 10.9.x - 'Fantastico' Local File Inclusion2007-03-11 · webapps · php · Verified
Impact
Multiple absolute path traversal vulnerabilities in Fantastico, as used with cPanel 10.x, allow remote authenticated users to include and execute arbitrary local files via (1) the userlanguage parameter to includes/load_language.php or (2) the fantasticopath parameter to includes/mysqlconfig.php and certain other files.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cpanel-Host | Fantastico De Luxe | All versions |
References
- NVD record
- CVE.org record
- http://osvdb.org/35036
- http://osvdb.org/35037
- http://securityreason.com/securityalert/2420
- http://www.securityfocus.com/archive/1/462562/100/0/threaded
- http://osvdb.org/35036
- http://osvdb.org/35037
- http://securityreason.com/securityalert/2420
- http://www.securityfocus.com/archive/1/462562/100/0/threaded