CWE Code: 22
Vulnerability Type: privilege_escalation
CVSS Score: 6.8
CWE Name:  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary: directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the fantastico de luxe module for cpanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a goahead action.  note: this issue only crosses privilege boundaries when security settings such as disable_functions and safe_mode are active, since exploitation requires uploading of executable code to a home directory.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2009-08-10
Last Modified Date: 2018-10-11