Contao Core directory traversal vulnerability
A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-10993US | high8.8 | — | ||
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal. | ||||
02
references
External citations — patches, advisories, analysis.
- https://contao.org/en/news/contao-3_5_28.htmlWEB
- https://contao.org/en/news/contao-4_4_1.htmlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2017-10993.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2017-10993.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2017-10993.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-10993ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan