Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-9261. PoCs published by Kacper Szurek.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file download vulnerability in Codoforum 2.5.1 due to improper sanitization of the file path parameter. The `sanitize` function fails to return the sanitized value, allowing directory traversal attacks.
Description
The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.
Exploits (1)
This exploit demonstrates an arbitrary file download vulnerability in Codoforum 2.5.1 due to improper sanitization of the file path parameter. The `sanitize` function fails to return the sanitized value, allowing directory traversal attacks.