medium6.8Public exploit code
CVE-2008-0478
Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary local files via a ..
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SetCMS 3.6.5 - Remote Command Execution2008-01-22 · webapps · php · Verified
Impact
Directory traversal vulnerability in index.php in SetCMS 3.6.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set parameter, as demonstrated by sending a certain CLIENT_IP HTTP header in an enter action to index.php, and injecting PHP sequences into files/enter.set, which is then included by index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Setcms | Setcms | Version 3.6.5 |