CVE-2008-2650 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.01643.

Key SSVC decision points have not yet been added.

Vendors	Products
Cmsimple Subscribe	Cmsimple Subscribe

Configuration 1 [-]

cpe:2.3:a:cmsimple:cmsimple:3.1:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2008-2645	Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://osvdb.org/45881
http://secunia.com/advisories/30463
http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17
http://www.securityfocus.com/bid/29450
https://exchange.xforce.ibmcloud.com/vulnerabilities/42792
https://exchange.xforce.ibmcloud.com/vulnerabilities/42793
https://www.exploit-db.com/exploits/5700

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-06-10T18:00:00

Updated: 2024-08-07T09:05:30.471Z

Reserved: 2008-06-10T00:00:00

Link: CVE-2008-2650

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2008-06-10T18:32:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-2650

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-22

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-05-31T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "30463", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/30463"}, {"name": "45881", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/45881"}, {"name": "cmsimple-index-file-include(42792)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42792"}, {"name": "29450", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/29450"}, {"name": "5700", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/5700"}, {"name": "cmsimple-index-file-upload(42793)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42793"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-2650", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "30463", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/30463"}, {"name": "45881", "refsource": "OSVDB", "url": "http://osvdb.org/45881"}, {"name": "cmsimple-index-file-include(42792)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42792"}, {"name": "29450", "refsource": "BID", "url": "http://www.securityfocus.com/bid/29450"}, {"name": "5700", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/5700"}, {"name": "cmsimple-index-file-upload(42793)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42793"}, {"name": "http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17", "refsource": "CONFIRM", "url": "http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T09:05:30.471Z"}, "title": "CVE Program Container", "references": [{"name": "30463", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/30463"}, {"name": "45881", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/45881"}, {"name": "cmsimple-index-file-include(42792)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42792"}, {"name": "29450", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/29450"}, {"name": "5700", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/5700"}, {"name": "cmsimple-index-file-upload(42793)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42793"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-2650", "datePublished": "2008-06-10T18:00:00", "dateReserved": "2008-06-10T00:00:00", "dateUpdated": "2024-08-07T09:05:30.471Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cmsimple:cmsimple:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "7FD595C1-A544-46AF-82B1-025764436FA7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en cmsimple/cms.php in CMSimple 3.1, cuando register_globals se encuentra activado, permite a atacantes remotos incluir y ejecutar ficheros locales a trav\u00e9s de la secuencia .. (punto punto) en el par\u00e1metro sl al index.php. NOTA: esto puede ser aprovecharlo para realizar una ejecuci\u00f3n remota de fichero incluyendo adm.php y posteriormente invocando la acci\u00f3n de upload. NOTA: sobre la 20080601, el fabricante parche\u00f3 el producto sin modificar el n\u00famero de versi\u00f3n."}], "evaluatorSolution": "Upgrade requires login when downloads link is clicked from X-Force site.", "id": "CVE-2008-2650", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-06-10T18:32:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/45881"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/30463"}, {"source": "cve@mitre.org", "url": "http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/29450"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42792"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42793"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/5700"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/45881"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/30463"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.cmsimple.com/forum/viewtopic.php?f=2&t=17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/29450"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42792"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42793"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/5700"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}