CVE-2008-2650: Path Traversal

Published Jun 10, 2008

Updated

Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.

Affected Software

1 affected component

CmSimple CMSimple=3.1

Event History

Jun 10, 2008

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2650?

CVE-2008-2650 has a medium severity rating due to its potential for remote file inclusion attacks.

How do I fix CVE-2008-2650?

To fix CVE-2008-2650, disable register_globals and ensure your CMSimple installation is updated to the latest version.

What systems are affected by CVE-2008-2650?

CVE-2008-2650 affects CMSimple version 3.1 when register_globals is enabled.

Can CVE-2008-2650 lead to remote code execution?

Yes, CVE-2008-2650 can be exploited to achieve remote code execution by including arbitrary local files.

What type of attack does CVE-2008-2650 enable?

CVE-2008-2650 enables directory traversal attacks that can lead to unauthorized access to sensitive files.