Exploitation Summary
EIP tracks 2 public exploits for CVE-2008-0094. PoCs published by AmnPardaz Security Research Team.
AI-analyzed exploit summary This exploit leverages a path traversal vulnerability in MODx to retrieve arbitrary files from the server. The vulnerability arises due to improper sanitization of user-supplied input in the 'file' parameter of 'htcmime.php'.
Description
Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and (2) read arbitrary local files via a .. (dot dot) in the file parameter to assets/js/htcmime.php.
Exploits (2)
This exploit leverages a path traversal vulnerability in MODx to retrieve arbitrary files from the server. The vulnerability arises due to improper sanitization of user-supplied input in the 'file' parameter of 'htcmime.php'.
This exploit demonstrates a local file inclusion vulnerability in MODx 0.9.6.1 by manipulating the 'as_language' parameter to include arbitrary files via directory traversal. The 'q' parameter is used to specify the file to be included, allowing potential execution of local script code.