Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Interact 2.4.1 help page lets attackers run local files

CVE-2008-3384 · published 18 years ago
Summary

The help.php page in Interact Learning Community Environment version 2.4.1 can be tricked into loading files from the server’s own file system. An attacker could cause the system to execute those files, potentially taking control of the server or exposing data. Apply the vendor’s security update or disable the vulnerable help page until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cce-interact interact 2.4.1
cpe:2.3:a:cce-interact:interact:2.4.1:*:*:*:*:*:*:*
Original advisory text
Multiple directory traversal vulnerabilities in help/help.php in Interact Learning Community Environment Interact 2.4.1 allow remote attackers to include and execute arbitrary local files via a .. ...
Multiple directory traversal vulnerabilities in help/help.php in Interact Learning Community Environment Interact 2.4.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) module and (2) file parameters.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published30 Jul 2008
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-3384 · NVD
Track software like this
Free during beta