Bitrix bitrix.mpbuilder Module < 1.0.12 bitrix.mpbuilder_step2.php 'work[]' Path Traversal File Inclusion

The version of the Bitrix bitrix.mpbuilder module running on the remote web server is prior to 1.0.12. It is, therefore, affected by a path traversal vulnerability due to a failure to properly sanitize user-supplied input to the 'work' parameter passed to the /bitrix/admin/bitrix.mpbuilderstep2.p...

The vulnerability of the 1C-Bitrix web project management system allows a hacker to implant and exploit any arbitrary local file.

The vulnerability of the bitrix.mpbuilder module of the 1C-Bitrix web project management system exists due to insufficient restrictions on the path name to the directory. Exploiting this vulnerability allows a malicious actor to remotely introduce and open any local file by adding the symbol “..”...

CVE-2015-8358

Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. dot dot in the element name of the "work" array parameter to admin/bitrix.mpbuilderstep2.php...