CVE-2008-2350: Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1)

Unscored severity · published May 20, 2008

CVE-2008-2350

Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1)

–

CVSS

2.7%

EPSS

On KEV

Description

Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (dot dot) or (2) C: folder sequences in the file parameter.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.7% · higher than 86% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Bcoos · Bcoos

1.0.9; 1.0.10; 1.0.11; 1.0.12; 1.0.13 · source: NVD

Affected product

Bcoos

All Bcoos CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2008-2350

CVE.org

https://www.cve.org/CVERecord?id=CVE-2008-2350

Exploit

http://lostmon.blogspot.com/2008/05/bcoos-highlightphp-traversal-file.html

Vendor Advisory

http://secunia.com/advisories/30035

Exploit

http://www.securityfocus.com/bid/29275

exchange.xforce.ibmcloud.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/42506