PT-2012-3086 · Open Realty · Open-Realty Cms

Aung Khant · Published 2012-09-06 · Updated 2017-08-29 · CVE-2012-1112

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open-Realty CMS versions 2.5.8 and earlier

Description A directory traversal issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the select users template parameter to the "index.php" endpoint.

Recommendations For Open-Realty CMS versions 2.5.8 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-1112

Affected Products

Open-Realty Cms

References · 9

• 🔥 http://openwall.com/lists/oss-security/2012/03/05/14 · Exploit
• 🔥 http://securityfocus.com/bid/52296 · Exploit
• 🔥 https://exploit-db.com/exploits/36910 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-03/0012.html · Exploit
• 🔥 http://yehg.net/lab/pr0js/advisories/%5Bopen-realty_2.5.8_2.x%5D_lfi · Exploit
• 🔥 http://openwall.com/lists/oss-security/2012/03/05/23 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1112 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73736 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1112 · Note