Directory traversal

2010-03-1920:30:00

PRIOn knowledge base

www.prio-n.com

7.6 High

AI Score

Confidence

Low

0.038 Low

EPSS

Percentile

91.9%

JSON

Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execute arbitrary local files via a … (dot dot) in the langname parameter.

CPENameOperatorVersion
efronteq3.5.5
efronteq3.5.2
efronteq3.5.0
efronteq3.5.1
efronteq3.5.3
efronteq3.5.4

Name	Operator	Version
efront	eq	3.5.5
efront	eq	3.5.2
efront	eq	3.5.0
efront	eq	3.5.1
efront	eq	3.5.3
efront	eq	3.5.4

References

forum.efrontlearning.net/viewtopic.php?f=15&t=1945

osvdb.org/63028

www.coresecurity.com/content/efront-php-file-inclusion

www.efrontlearning.net/product/efront-news/265-important-security-fix.html

www.securityfocus.com/archive/1/510155/100/0/threaded

www.securityfocus.com/bid/38787