PT-2008-5480 · Cpanel · Fantastico De Luxe

Joker_1 · Published 2008-09-23 · Updated 2017-09-29 · CVE-2008-4181

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fantastico De Luxe module versions prior to 2.10.4 r19

Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) or absolute pathname in the fantasticopath parameter. This can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL in certain environments.

Recommendations For versions prior to 2.10.4 r19, update to version 2.10.4 r19 or later to resolve the issue. As a temporary workaround, consider disabling the cPanel PHP Register Globals feature to minimize the risk of exploitation. Restrict access to the includes/xml.php file to prevent unauthorized inclusion and execution of local files. Avoid using the fantasticopath parameter with untrusted input until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-4181

Affected Products

Fantastico De Luxe

References · 7

• 🔥 https://exploit-db.com/exploits/6461 · Exploit
• http://securityfocus.com/bid/31196 · Patch
• http://netenberg.com/forum/index.php?topic=6768.0 · Patch
• http://secunia.com/advisories/31863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4181 · Security Note
• http://securityreason.com/securityalert/4301 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45147 · Note