CVE-2007-6584

Published: Dec 28, 2007Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang parameter to pages/print/default/ops/news.php or (2) the theme_dir parameter to pages/download/default/ops/search.php; or the admin_theme_dir parameter to (3) download.php, (4) forum.php, or (5) news.php in admin/ops/reports/ops/. NOTE: it was later reported that 1.4.2 beta and earlier are also affected for vector 1.

Affected (4)

Products: 1024 Cms: 1024 Cms

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
1024 Cms 1024 Cms	Version 1.3.1
1024 Cms 1024 Cms	Version 1.4.1
1024 Cms 1024 Cms	Version 1.4.2
1024 Cms 1024 Cms	Version 1.4.2 beta

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (18)

http://osvdb.org/41280

Source: cve@mitre.org

http://osvdb.org/41281

Source: cve@mitre.org

http://osvdb.org/41282

Source: cve@mitre.org

http://osvdb.org/41283

Source: cve@mitre.org

http://osvdb.org/41284

Source: cve@mitre.org

http://secunia.com/advisories/29810

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/28753

Source: cve@mitre.org

https://www.exploit-db.com/exploits/4765

Source: cve@mitre.org

https://www.exploit-db.com/exploits/5434

Source: cve@mitre.org

http://osvdb.org/41280

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/41281

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/41282

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/41283

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/41284

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/29810

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/28753

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/4765

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/5434

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.