| Package | Affected versions | Patched versions |
|---|---|---|
| xoops | = 2.0= 2.0.1= 2.0.10= 2.0.11= 2.0.12_jp= 2.0.13.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.5.1= 2.0.5.2= 2.0.6= 2.0.7= 2.0.9= 2.0.9.2= 2.0.9.3≤ 2.0.13.2 |
mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free