Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-20647: Car Rental Script allows unauthorized directory browsing

CVE-2018-20647 · published 7 years ago

Summary

The Car Rental Script version 2.0.8 lets anyone request a folder path and see the contents of directories such as the images folder. This could expose sensitive files or system information. Update the script to the latest version or apply the vendor’s patch to block directory traversal requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
car_rental_script_project	car_rental_script	2.0.8 `cpe:2.3:a:car_rental_script_project:car_rental_script:2.0.8:::::::*`

Original advisory text

PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory.

References

https://gkaim.com/cve-2018-20647-vikas-chaudhary/ Exploit Third Party Advisory
https://gkaim.com/cvehttps://gkaim.com/cve-2018-20647-vikas-chaudhary/ Broken Link Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published21 Mar 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-20647 · NVD

Track software like this

Free during beta