high8.5Public exploit code
CVE-2013-5692
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a ..
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- X2CRM 3.4.1 - Multiple Vulnerabilities2013-09-25 · webapps · php
Impact
Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php/admin/translationManager.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| X2engine | X2crm | through 3.4.1 Versions 1.0, 1.0.1, 1.1.0, 1.2.0, 1.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2013-09/0117.html
- http://osvdb.org/97365
- http://www.exploit-db.com/exploits/28557
- https://www.htbridge.com/advisory/HTB23172
- http://archives.neohapsis.com/archives/bugtraq/2013-09/0117.html
- http://osvdb.org/97365
- http://www.exploit-db.com/exploits/28557
- https://www.htbridge.com/advisory/HTB23172