CVE-2010-0967 in ADMP
Summary
by MITRE
Multiple directory traversal vulnerabilities in Geekhelps ADMP 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the style parameter to (1) colorvoid/footer.php, (2) default-green/footer.php, (3) default-orange/footer.php, and (4) default/footer.php in themes/. NOTE: some of these details are obtained from third party information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability identified as CVE-2010-0967 represents a critical directory traversal flaw affecting Geekhelps ADMP 1.01 content management system. This security weakness arises from insufficient input validation mechanisms within the application's theme handling functionality, specifically impacting four distinct footer.php files located in different theme directories. The vulnerability becomes exploitable when the PHP configuration parameter magic_quotes_gpc is disabled, which removes the automatic escaping of special characters that would otherwise prevent malicious input from being interpreted as file system commands.
The technical exploitation of this vulnerability occurs through manipulation of the style parameter in the affected PHP scripts, allowing attackers to craft directory traversal sequences that bypass normal file access controls. When an attacker submits malicious input containing sequences such as ../../ or ../../../, the application fails to properly sanitize this input before using it to include local files. This flaw directly maps to CWE-22, which defines improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The vulnerability enables attackers to access arbitrary local files on the server, potentially including configuration files, database credentials, or other sensitive system resources that should remain protected from unauthorized access.
The operational impact of this vulnerability extends beyond simple file disclosure, as it allows for remote code execution capabilities when combined with appropriate attack vectors. Attackers can leverage this weakness to include and execute arbitrary local files, effectively granting them the ability to execute arbitrary commands on the vulnerable server. This represents a significant escalation from simple information disclosure to full system compromise, as demonstrated by the ATT&CK framework's technique T1059 for command and script interpreter. The vulnerability affects multiple theme files simultaneously, indicating a systemic design flaw in how the application processes user-supplied parameters for theme customization, rather than being limited to a single point of failure.
Mitigation strategies for this vulnerability must address both the immediate security flaw and the underlying architectural issues that enabled the exploitation. Organizations should implement proper input validation and sanitization mechanisms that prevent directory traversal sequences from being processed as legitimate file paths. This includes implementing strict parameter validation for the style parameter and ensuring that all user-supplied input undergoes comprehensive sanitization before being used in file inclusion operations. Additionally, the magic_quotes_gpc directive should be properly configured or alternative protection mechanisms should be implemented since disabling this feature creates additional attack surface. The recommended approach aligns with security best practices outlined in the OWASP Top Ten and follows the principle of least privilege by ensuring that applications operate with minimal required permissions and that all file access operations are properly validated against a whitelist of acceptable paths. Organizations should also implement proper access controls and monitoring to detect and prevent unauthorized file access attempts, as the vulnerability can be exploited without authentication when the application is accessible to remote attackers.