CVE-2012-1617

🗓️ 26 Sep 2012 00:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Directory traversal vulnerability in OSClass allows file access via type parameter exploitation.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2012-1617	7 Mar 201200:00	–	circl
Cvelist	CVE-2012-1617	26 Sep 201200:00	–	cvelist
Exploit DB	OSClass 2.3.x - Directory Traversal / Arbitrary File Upload	7 Mar 201200:00	–	exploitdb
Mend	CVE-2012-1617	26 Sep 201200:00	–	mend
NVD	CVE-2012-1617	26 Sep 201200:55	–	nvd
Prion	Directory traversal	26 Sep 201200:55	–	prion
Positive Technologies	PT-2012-3385	26 Sep 201200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2012-1617: Improper Limitation of a Pathname to a Restricted Directory	26 Sep 201200:00	–	rapid7

NVD

Node

Source	Link
openwall	www.openwall.com/lists/oss-security/2012/04/02/1
openwall	www.openwall.com/lists/oss-security/2012/04/03/1
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/73755
github	www.github.com/osclass/OSClass/commit/a40b76695994442644e46e1b776d79660500566a
osclass	www.osclass.org/2012/03/05/osclass-2-3-6/
openwall	www.openwall.com/lists/oss-security/2012/04/04/7
github	www.github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f
github	www.github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b
codseq	www.codseq.it/advisories/osclass_directory_traversal_vulnerability
openwall	www.openwall.com/lists/oss-security/2012/04/02/6

Parameter	Position	Path	Description	CWE
type	query param	/osclass/oc-content/themes/modern/combine.php?type=./../../uploads/combine.php&files=combine.php	Directory traversal via combine.php allowing moving/uploading files (arbitrary PHP).	CWE-22
files	query param	/osclass/oc-content/themes/modern/combine.php?type=./../../uploads/combine.php&files=combine.php	Directory traversal via combine.php allowing moving/uploading files (arbitrary PHP).	CWE-22
files	query param	/osclass/oc-content/uploads/combine.php?files=5_original.jpg&type=/../../remote.php	Arbitrary file upload via combine.php enabling placement of a PHP file at remote.php and later execution.	CWE-22
type	query param	/osclass/oc-content/uploads/combine.php?files=5_original.jpg&type=/../../remote.php	Arbitrary file upload via combine.php enabling placement of a PHP file at remote.php and later execution.	CWE-22
files	query param	/osclass/combine.php?files=config.php	Directory traversal to download config.php via combine.php.	CWE-22

16 Jun 2026 23:39Current

6.9Medium risk

Vulners AI Score6.9

CVSS 26.4

EPSS0.09942