Unscored CVE-2014-7985 EUVD-2014-7834GHSA-xmx2-q3rp-q8fq

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (do…

Published Oct 31, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

Directory traversal vulnerability in EspoCRM before 2.6.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter to install/index.php.

References

20141029 Multiple vulnerabilities in EspoCRM mailing-list
http://blog.espocrm.com/news/espocrm-2-6-0-released
http://packetstormsecurity.com/files/128888/EspoCRM-2.5.2-XSS-LFI-Access-Control.html
70809 vdb-entry
https://www.htbridge.com/advisory/HTB23238