CVE-2018-25439: MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the strreplace filter to read files like configdb.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MetInfo CMSto a version that resolves this vulnerability.Fixed in 6.1.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MetInfo CMS versions from 6.0.0 up to, but not including, 6.1.1 are affected. The described filter bypass and example file disclosure apply to deployments running on Windows.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can send a crafted request to /include/thumb.php using the dir parameter; no user interaction is required.
What can an attacker obtain through successful exploitation?
The vulnerability allows arbitrary file reading. The reported Windows bypass can expose files such as config_db.php, which may contain database configuration information.
How can I assess whether exploitation may already have occurred?
Review web-server and application logs for requests to /include/thumb.php with a dir parameter, especially values containing backslash-based traversal sequences. Exploitation evidence was first observed on 2023-10-14.