Directory Traversal Vulnerabilities in e-Vision CMS by e-Vision
CVE-2007-3251

Currently unrated

Key Information:

Vendor

E-vision

Status
E-vision Cms
Vendor
CVE Published:
18 June 2007

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 16%

What is CVE-2007-3251?

e-Vision CMS 2.02 and prior versions are susceptible to multiple directory traversal vulnerabilities that allow remote attackers to manipulate file paths. Specifically, these flaws enable attackers to include and execute arbitrary local files via code injection in the adminlang cookie directed to admin/functions.php. Furthermore, attackers can access any local file by exploiting the img parameter in admin/show_img.php, leading to potentially severe data breaches.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2007-3251 - Proof of Concept

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/34792
vdb-entryx_refsource_XF
http://www.securityfocus.com/bid/24398
vdb-entryx_refsource_BID
https://www.exploit-db.com/exploits/4054
exploitx_refsource_EXPLOIT-DB

EPSS Score

16% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.