CVE-2005-0828: Medium severity Runcms RunCMS vulnerability

Published Mar 22, 2005

Updated

highlight.php in (1) RUNCMS 1.1A, (2) CIAMOS 0.9.2 RC1, (3) e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allows remote attackers to read arbitrary PHP files by specifying the pathname in the file parameter, as demonstrated by reading database configuration information from mainfile.php.

Affected Software

3 affected components

Runcms RunCMS=1.1a

E-XooPS E-XooPS=1.05r3

Ciamos Ciamos=0.9.2_rc1

Remediation

Patch Available

http://secunia.com/advisories/14641

Event History

Mar 22, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-0828?

CVE-2005-0828 has a medium severity level due to its potential for remote file reading exploits.

How do I fix CVE-2005-0828?

To fix CVE-2005-0828, ensure that access controls are implemented on sensitive files and upgrade to a patched version of the affected software.

Which software products are affected by CVE-2005-0828?

CVE-2005-0828 affects RUNCMS 1.1A, CIAMOS 0.9.2 RC1, and E-xoops 1.05 Rev3.

What type of vulnerability is CVE-2005-0828?

CVE-2005-0828 is a file inclusion vulnerability that allows attackers to read arbitrary PHP files.

Can CVE-2005-0828 lead to sensitive data exposure?

Yes, CVE-2005-0828 can lead to the exposure of sensitive data such as database configuration information.