CVE-2015-4181

HIGH

phpMyBackupPro 2.1-2.5 - Path Traversal via View Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-4181. PoCs published by Amol Naik.

AI-analyzed exploit summary This exploit demonstrates an arbitrary file download vulnerability in phpMyBackupPro due to improper sanitization of the 'view' parameter in get_file.php. The PoC shows how an attacker can download sensitive files like /etc/passwd by manipulating the URL.

Description

Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this vulnerability exists due to an incomplete fix to CVE-2015-4180.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Amol Naik · textwebappsphp
https://www.exploit-db.com/exploits/10169

This exploit demonstrates an arbitrary file download vulnerability in phpMyBackupPro due to improper sanitization of the 'view' parameter in get_file.php. The PoC shows how an attacker can download sensitive files like /etc/passwd by manipulating the URL.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: phpMyBackupPro v2.1 and earlier
No auth needed
Prerequisites: Access to the vulnerable get_file.php endpoint
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/06/04/10

Scores

CVSS v3 7.5
EPSS 0.1157
EPSS Percentile 95.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (5)
phpmybackuppro/phpmybackuppro 2.1
phpmybackuppro/phpmybackuppro 2.2
phpmybackuppro/phpmybackuppro 2.3
phpmybackuppro/phpmybackuppro 2.4
phpmybackuppro/phpmybackuppro 2.5
Published Aug 25, 2017
Tracked Since Feb 18, 2026