CVE-2008-6172: Path Traversal
Directory traversal vulnerability in captcha/captchaimage.php in the RWCards (comrwcards) 3.0.11 component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable magic_quotes_gpc in your php.ini (set magic_quotes_gpc = On) to mitigate the directory traversal vulnerability in RWCards (com_rwcards) 3.0.11 that occurs when magic_quotes_gpc is disabled.
PHP magic_quotes_gpc = On
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6172?
CVE-2008-6172 is considered a high severity vulnerability due to the potential for remote file inclusion and execution of arbitrary code.
How do I fix CVE-2008-6172?
To fix CVE-2008-6172, you should upgrade the RWCards component to a version that addresses this vulnerability.
What software is affected by CVE-2008-6172?
CVE-2008-6172 specifically affects the RWCards (com_rwcards) version 3.0.11 component for Joomla!.
What exploit can be carried out using CVE-2008-6172?
An attacker can exploit CVE-2008-6172 to execute arbitrary local files on the server via directory traversal sequences in the img parameter.
Is magic_quotes_gpc related to CVE-2008-6172?
Yes, CVE-2008-6172 occurs when magic_quotes_gpc is disabled, making the application vulnerable to directory traversal attacks.