critical9.0Public exploit code
CVE-2015-8358
Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local f…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion2015-12-14 · webapps · php
Impact
Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bitrix | Mpbuilder | through 1.0.11 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/134766/bitrix.mpbuilder-Bitrix-1.0.10-Local-File-Inclusion.html
- http://www.securityfocus.com/archive/1/537067/100/0/threaded
- https://marketplace.1c-bitrix.ru/solutions/bitrix.mpbuilder/#tab-log-link
- https://www.exploit-db.com/exploits/38975/
- https://www.htbridge.com/advisory/HTB23281
- http://packetstormsecurity.com/files/134766/bitrix.mpbuilder-Bitrix-1.0.10-Local-File-Inclusion.html
- http://www.securityfocus.com/archive/1/537067/100/0/threaded
- https://marketplace.1c-bitrix.ru/solutions/bitrix.mpbuilder/#tab-log-link
- https://www.exploit-db.com/exploits/38975/
- https://www.htbridge.com/advisory/HTB23281