CVE-2014-9574
HighSummary
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code on the server, potentially leading to system compromise and data loss.
Recommendation
It is recommended to upgrade FluxBB to version 1.5.8 or later to mitigate this vulnerability.
Other vulnerabilities in FluxBB
See all- CVE-2014-10029High
CVE-2014-10029 is a SQL injection vulnerability in profile.php in FluxBB before version 1.4.13 and 1.5.x before version 1.5.7. It allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
- CVE-2021-43677Medium
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
- CVE-2020-28873High
Fluxbb 1.5.11 is vulnerable to a denial of service (DoS) attack by sending an extremely long password via the login form. The password hashing process exhausts CPU and memory resources on the server.
Original NVD description (English source)
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.