CVE-2008-3415 json
Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and ex…
published 2008-07-31 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3401
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 87%
- public exploits
- 1
- Exploit-DB
Summary
Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bit parameter, as demonstrated by an upload to avatar/ of a .jpg file containing PHP sequences.
Timeline
- First public exploit (EDB-6142)
- Published
Exploit prediction
2.94% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-6142 CMScout 2.05 - 'bit' Local File Inclusion webapps, 2008-07-27
- secunia.com http://secunia.com/advisories/31243 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
exploit-db.com
/exploits/6142
exploit
-
secunia.com
/advisories/31243
third-party-advisory, exploit, vendor-advisory
- cmscout.co.za /index.php?page=news&id=29
-
securityreason.com
/securityalert/4093
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/44017
vdb-entry
-
vupen.com
/english/advisories/2008/2218/references
vdb-entry
-
securityfocus.com
/bid/30385
vdb-entry
Sources
- CVE List CVE-2008-3415
- NVD CVE-2008-3415
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.