CVE-2008-2482

insanevisions OneCMS 2.5 - Path Traversal via install_mod.php load Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2482. PoCs published by DSecRG.

AI-analyzed exploit summary This exploit demonstrates a Local File Include (LFI) vulnerability in OneCMS 2.5 via the 'load' parameter in install_mod.php. The vulnerability allows an attacker to include arbitrary files by traversing directories, as shown in the example URL.

Description

Directory traversal vulnerability in install_mod.php in insanevisions OneCMS 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter in a go action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by DSecRG · textwebappsphp

https://www.exploit-db.com/exploits/5669

View Code ZIP pw:eip

This exploit demonstrates a Local File Include (LFI) vulnerability in OneCMS 2.5 via the 'load' parameter in install_mod.php. The vulnerability allows an attacker to include arbitrary files by traversing directories, as shown in the example URL.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: OneCMS 2.5

No auth needed

Prerequisites: Access to the install_mod.php script

MITRE ATT&CK