PT-2014-6292 · Dirphp · Dirphp

Black Hat · Published 2014-07-29 · Updated 2014-08-27 · CVE-2014-5115

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DirPHP version 1.0

Description The issue allows remote attackers to read arbitrary files by providing a full pathname in the phpfile parameter to the "index.php" endpoint.

Recommendations For DirPHP version 1.0, consider restricting access to the phpfile parameter in the "index.php" endpoint to prevent arbitrary file reading until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-5115

Affected Products

Dirphp

References · 4

• 🔥 https://exploit-db.com/exploits/34173 · Exploit
• 🔥 http://exploit-db.com/exploits/34173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5115 · Security Note
• http://packetstormsecurity.com/files/127642/DirPHP-1.0-Local-File-Inclusion.html · Note