Directory Traversal Vulnerability in CuteNews by CuteNews

CVE-2007-6662

What is CVE-2007-6662?

A directory traversal vulnerability exists in the file.php component of CuteNews version 2.6. This security flaw allows remote attackers to manipulate the 'file' parameter using '../' sequences, enabling them to read arbitrary files on the server. An attacker could potentially access sensitive information, such as the admin username and password hash stored in 'data/users.db.php', resulting in unauthorized access to the CuteNews system. Organizations using this outdated version should consider applying security patches and updating to prevent exploitation.

References