medium5.0Public exploit code
CVE-2013-7190
Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- iScripts AutoHoster - 'id' Local File Inclusion2013-12-15 · webapps · php · Verified
- iScripts AutoHoster - 'fname' Local File Inclusion2013-12-15 · webapps · php · Verified
- iScripts AutoHoster - 'tmpid' Local File Inclusion2013-12-15 · webapps · php · Verified
- iScripts AutoHoster - 'main_smtp.php' Traversal2013-12-15 · webapps · php · Verified
Impact
Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter to admin/downloadfile.php, or (3) id parameter to support/admin/csvdownload.php; or (4) have an unspecified impact via unspecified vectors in support/parser/main_smtp.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Iscripts | Autohoster | Version 2.4 |