Directory traversal

2007-09-0519:17:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.0%

JSON

Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a “/…/” sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.

CPENameOperatorVersion
ragnarok_online_control_paneleq4.3.497

CPE	Name	Operator	Version
	ragnarok_online_control_panel	eq	4.3.497

References

osvdb.org/45879

securityreason.com/securityalert/3100

www.securityfocus.com/archive/1/478263/100/0/threaded