Vulnerability Description
highlight.php in (1) RUNCMS 1.1A, (2) CIAMOS 0.9.2 RC1, (3) e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allows remote attackers to read arbitrary PHP files by specifying the pathname in the file parameter, as demonstrated by reading database configuration information from mainfile.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ciamos | Ciamos | 0.9.2_rc1 |
| E-Xoops | E-Xoops | 1.05r3 |
| Runcms | Runcms | 1.1a |
References
- http://marc.info/?l=bugtraq&m=111117241923006&w=2
- http://marc.info/?l=bugtraq&m=111125645312693&w=2
- http://secunia.com/advisories/14641PatchVendor Advisory
- http://secunia.com/advisories/14648Vendor Advisory
- http://securitytracker.com/id?1013485
- http://www.ihsteam.com/download/advisory/Exoops%20highlight%20hole.txtExploitURL Repurposed
- http://www.ihsteam.com/download/sections/runcms%20advisory%20-%20eng.pdfVendor AdvisoryURL Repurposed
- http://www.osvdb.org/14890
- http://www.securityfocus.com/bid/12848Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19754
- http://marc.info/?l=bugtraq&m=111117241923006&w=2
- http://marc.info/?l=bugtraq&m=111125645312693&w=2
- http://secunia.com/advisories/14641PatchVendor Advisory
- http://secunia.com/advisories/14648Vendor Advisory
- http://securitytracker.com/id?1013485
FAQ
What is CVE-2005-0828?
CVE-2005-0828 is a vulnerability with a CVSS score of 5.0 (MEDIUM). highlight.php in (1) RUNCMS 1.1A, (2) CIAMOS 0.9.2 RC1, (3) e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allows remote attackers to read arbitrary PHP files by specifying ...
How severe is CVE-2005-0828?
CVE-2005-0828 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-0828?
Check the references section above for vendor advisories and patch information. Affected products include: Ciamos Ciamos, E-Xoops E-Xoops, Runcms Runcms.