Description
Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs.
Exploits (1)
References (3)
Core 3
Core References
Various Sources x_refsource_misc
http://www.auracms.org/?pilih=news&aksi=lihat&id=117
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/40506
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/4390
Scores
EPSS
0.0371
EPSS Percentile
88.0%
Details
CWE
CWE-94
Status
published
Products (10)
auracms/auracms
1.0
auracms/auracms
1.1
auracms/auracms
1.2
auracms/auracms
1.3
auracms/auracms
1.5
auracms/auracms
1.6_beta
auracms/auracms
1.61
auracms/auracms
1.62
auracms/auracms
2.0
auracms/auracms
2.1
Published
Sep 14, 2007
Tracked Since
Feb 18, 2026