CVE-2007-6567

XZero Community Classifieds <4.95.11 - Path Traversal

Title source: llm

Description

Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter in a page view action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kw3[R]Ln · perlwebappsphp

https://www.exploit-db.com/exploits/4794

View Code ZIP pw:eip

References (6)

[Third Party Advisory, VDB Entry] http://osvdb.org/39741

[Various Sources] http://en.rstzone.org/xzero-community-classifieds-v4-95-11-lfi-sql-in-t9394.rst

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/485545/100/0/threaded

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/39260

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/4794

[Exploit] http://www.securityfocus.com/bid/27041

Scores

EPSS 0.0673

EPSS Percentile 91.3%

Details

CWE

CWE-22

Status published

Products (1)

xzero_scripts/xzero_community_classifieds < 4.95.11

Published Dec 28, 2007

Tracked Since Feb 18, 2026