CVE-2007-6079: Path Traversal
Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the xoopsOption[pagetype] parameter to the default URI for modules/news/. NOTE: this can be leveraged by using legitimate product functionality to upload a file that contains the code, then including that file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6079?
CVE-2007-6079 is considered a moderate severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2007-6079?
To fix CVE-2007-6079, upgrade Bcoos to a version that is not vulnerable, ideally above 1.0.10.
What is the impact of exploiting CVE-2007-6079?
Exploiting CVE-2007-6079 allows attackers to include and execute arbitrary local files on the server.
Is CVE-2007-6079 present in all versions of Bcoos?
CVE-2007-6079 specifically affects Bcoos version 1.0.10; other versions may not be impacted.
What components are affected by CVE-2007-6079?
CVE-2007-6079 affects the include/common.php file in the Bcoos application.