Description
S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending traversal sequences and a null byte to bypass file extension checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| S40 CMS | S40 CMS | 0.4.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
S40 0.4.2 CMS Directory Traversal Vulnerability
auxiliary/scanner/http/s40_traversal
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/s40_traversal.rb exploit
- https://www.exploit-db.com/exploits/17129 exploit
- https://web.archive.org/web/20110613222630/http://y-osirys.com/security/exploits/id27 technical-description exploit
- https://web.archive.org/web/20120531114058/http://s40.biz/ product
- https://www.vulncheck.com/advisories/s40-cms-path-traversal third-party-advisory