Join our subscribers
Local File Inclusion in PluXml
This vulnerability was discovered by our security researchers before 2019.
| Advisory ID: | HTB23086 |
| Product: | PluXml |
| Vendor: | PluXml |
| Vulnerable Versions: | 5.1.5 and probably prior |
| Tested Version: | 5.1.5 |
| Advisory Publication: | April 11, 2012 [without technical details] |
| Vendor Notification: | April 11, 2012 |
| Vendor Fix: | April 16, 2012 |
| Public Disclosure: | May 2, 2012 |
| Latest Update: | April 18, 2012 |
| Vulnerability Type: | PHP File Inclusion [CWE-98] |
| CVE Reference: | CVE-2012-2227 |
| Risk Level: | High |
 | |
| CVSSv2 Base Score: | 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in PluXml, which can be exploited to perform Local File Inclusion attacks. | |
| Solution: | |
| Upgrade to PluXml 5.1.6 More Information: http://www.pluxml.org/article59/sortie-de-pluxml-5-1-6 http://telechargements.pluxml.org/changelog | |
| | |
References: | |
| [1] High-Tech Bridge Advisory HTB23086 - https://www.immuniweb.com/advisory/HTB23086 - Local File Inclusion in PluXml. [2] PluXml - http://www.pluxml.org - PluXml is a script to create a site or a blog. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.