CVE-2011-10009

HIGH

S40 CMS 0.4.2 - Unauthenticated Path Traversal via Index.php p Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2011-10009. PoCs published by Osirys, including Metasploit module auxiliary/scanner/http/s40_traversal.

AI-analyzed exploit summary This is a security advisory detailing a Local File Inclusion (LFI) vulnerability in S40 CMS 0.4.2 Beta. The vulnerability arises due to insufficient input sanitization in the 'page()' function, allowing attackers to include arbitrary local files via a crafted GET request with a null byte.

Description

S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending traversal sequences and a null byte to bypass file extension checks.

Exploits (2)

exploitdb WRITEUP VERIFIED
by Osirys · textwebappsphp
https://www.exploit-db.com/exploits/17129

This is a security advisory detailing a Local File Inclusion (LFI) vulnerability in S40 CMS 0.4.2 Beta. The vulnerability arises due to insufficient input sanitization in the 'page()' function, allowing attackers to include arbitrary local files via a crafted GET request with a null byte.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: S40 CMS 0.4.2 Beta
No auth needed
Prerequisites: Access to the target web application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/s40_traversal.rb

This Metasploit module exploits a directory traversal vulnerability in S40 CMS 0.4.2 by manipulating the $pid parameter in the 'page' function to retrieve arbitrary files. It sends a crafted HTTP GET request with traversal sequences to access files like /etc/passwd.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: S40 CMS 0.4.2
No auth needed
Prerequisites: Network access to the target S40 CMS instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v4 8.7
EPSS 0.0156
EPSS Percentile 71.9%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
S40 CMS/S40 CMS 0.4.2
Published Aug 13, 2025
Tracked Since Feb 18, 2026