EIP-2026-114461
PRE-CVEXOOPS 2.3.3 - '.htaccess' Remote File Disclosure
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-114461. PoCs published by daath.
AI-analyzed exploit summary This exploit demonstrates a remote arbitrary file retrieval vulnerability in XOOPS <= 2.3.3. It leverages a vulnerable read_file() function in module_icon.php, allowing an attacker to read system or configuration files by manipulating the $mydirpath variable when register_globals is enabled and magic_quotes_gpc is disabled.
Description
XOOPS 2.3.3 - '.htaccess' Remote File Disclosure
Exploits (1)
This exploit demonstrates a remote arbitrary file retrieval vulnerability in XOOPS <= 2.3.3. It leverages a vulnerable read_file() function in module_icon.php, allowing an attacker to read system or configuration files by manipulating the $mydirpath variable when register_globals is enabled and magic_quotes_gpc is disabled.