CVE-2012-10034

HIGH

ClanSphere 2011.3 - Local File Inclusion

Title source: llm

Description

ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie parameter. The application fails to sanitize user-supplied input, allowing attackers to traverse directories and read arbitrary files outside the web root. The vulnerability is further exacerbated by null byte injection (%00) to bypass file extension checks.

Exploits (2)

exploitdb WORKING POC VERIFIED

by blkhtc0rp · textwebappsphp

https://www.exploit-db.com/exploits/22181

View Code ZIP pw:eip

metasploit WORKING POC

by blkhtc0rp, sinn3r · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/clansphere_traversal.rb

View Code ZIP pw:eip

References (4)

[Exploit, Third Party Advisory] https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/clansphere_traversal.rb

[Product] https://sourceforge.net/projects/clansphere/

[Exploit, VDB Entry] https://www.exploit-db.com/exploits/22181

[Third Party Advisory] https://www.vulncheck.com/advisories/clansphere-local-file-inclusion-via-cookie

Scores

CVSS v3 7.5

EPSS 0.2316

EPSS Percentile 96.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (2)

ClanSphere Project/ClanSphere 2011.3

csphere/clansphere 2011.3

Published Aug 05, 2025

Tracked Since Feb 18, 2026