Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Exero CMS 1.0.1 theme lets attackers run local files

CVE-2008-1409 · published 18 years ago
Summary

The default theme in Exero CMS version 1.0.1 contains directory‑traversal flaws that let an outside user trick the system into loading and executing files from the server. This can affect many parts of the site, such as login, user profiles, and news pages, potentially giving the attacker control of the server. Apply the vendor's security update or replace the default theme with a safe, updated one as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
exero exero_cms 1.0.1
cpe:2.3:a:exero:exero_cms:1.0.1:*:*:*:*:*:*:*
Original advisory text
Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the the...
Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme parameter to (1) index.php, (2) editpassword.php, and (3) avatar.php in usercp/; (4) custompage.php; (5) errors/404.php; (6) memberslist.php and (7) profile.php in members/; (8) index.php and (9) fullview.php in news/; and (10) nopermission.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published20 Mar 2008
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-1409 · NVD
Track software like this
Free during beta