phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence

2022-05-0107:08:17

Google

osv.dev

0.008 Low

EPSS

Percentile

81.1%

JSON

Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a … (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.

CPENameOperatorVersion
phpsysinfo/phpsysinfoeq3.2.1
phpsysinfo/phpsysinfoeq3.2.0
phpsysinfo/phpsysinfoeq3.2.3
phpsysinfo/phpsysinfoeq3.1.16
phpsysinfo/phpsysinfoeq3.1.14
phpsysinfo/phpsysinfoeq3.2.4
phpsysinfo/phpsysinfoeq3.1.15
phpsysinfo/phpsysinfoeq3.1.17
phpsysinfo/phpsysinfoeq3.2.2
phpsysinfo/phpsysinfoeq3.1.13

Name	Operator	Version
phpsysinfo/phpsysinfo	eq	3.2.1
phpsysinfo/phpsysinfo	eq	3.2.0
phpsysinfo/phpsysinfo	eq	3.2.3
phpsysinfo/phpsysinfo	eq	3.1.16
phpsysinfo/phpsysinfo	eq	3.1.14
phpsysinfo/phpsysinfo	eq	3.2.4
phpsysinfo/phpsysinfo	eq	3.1.15
phpsysinfo/phpsysinfo	eq	3.1.17
phpsysinfo/phpsysinfo	eq	3.2.2
phpsysinfo/phpsysinfo	eq	3.1.13