CVE-2011-0506

Tsixm Axdcms - Path Traversal

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-0506. PoCs published by n0n0x.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in axdcms-0.1.1 by manipulating the 'aXconf[default_language]' parameter to include arbitrary files, such as '/etc/passwd'. The vulnerability arises from insecure file inclusion in the 'modules/profile/user.php' script.

Description

Directory traversal vulnerability in modules/profile/user.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to execute arbitrary code via a .. (dot dot) in the aXconf[default_language] parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by n0n0x · textwebappsphp
https://www.exploit-db.com/exploits/15938

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in axdcms-0.1.1 by manipulating the 'aXconf[default_language]' parameter to include arbitrary files, such as '/etc/passwd'. The vulnerability arises from insecure file inclusion in the 'modules/profile/user.php' script.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: axdcms-0.1.1
No auth needed
Prerequisites: Access to the vulnerable web application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0071
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/15938
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/64547
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45735

Scores

EPSS 0.0329
EPSS Percentile 86.9%

Details

CWE
CWE-22
Status published
Products (1)
tsixm/axdcms 0.1.1
Published Jan 20, 2011
Tracked Since Feb 18, 2026