cve/cves/2011/CVE-2011-0518.md

CVE-2011-0518

Description

Directory traversal vulnerability in core/lib/router.php in LotusCMS Fraise 3.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via the system parameter to index.php.

POC

Reference

• http://www.exploit-db.com/exploits/15964

Github

No PoCs found on GitHub currently.

ExploitDB

• https://www.exploit-db.com/exploits/15964

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/lcms_php_exec.rb

Nuclei

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2011/CVE-2011-0518.yaml