CVE-2010-1058 in Address Book Script
Summary
by MITRE
Directory traversal vulnerability in codelib/cfg/common.inc.php in Phpkobo Address Book Script 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/03/2026
The vulnerability identified as CVE-2010-1058 represents a critical directory traversal flaw within the Phpkobo Address Book Script version 1.09, specifically affecting the codelib/cfg/common.inc.php file. This weakness stems from insufficient input validation mechanisms that fail to properly sanitize user-supplied parameters before they are processed within the application's file inclusion logic. The vulnerability manifests when the magic_quotes_gpc PHP configuration directive is disabled, creating an environment where malicious actors can exploit the lack of proper parameter sanitization to manipulate file paths and gain unauthorized access to local system resources.
The technical exploitation of this vulnerability occurs through manipulation of the LANG_CODE parameter, which is processed without adequate validation or sanitization measures. When attackers submit crafted input containing directory traversal sequences such as .. (dot dot), they can navigate outside the intended directory structure and access arbitrary local files on the server. This occurs because the application directly incorporates user-provided values into file inclusion operations without proper path validation or canonicalization. The vulnerability is classified under CWE-22 as a directory traversal attack, where an attacker can manipulate file paths to access files outside the intended scope of the application. The exploitation requires the specific condition of magic_quotes_gpc being disabled, which removes PHP's built-in protection against certain types of injection attacks, making the application particularly susceptible to path manipulation techniques.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass full system compromise potential. An attacker who successfully exploits this vulnerability can execute arbitrary code on the target system, potentially leading to complete server takeover, data exfiltration, or persistent backdoor installation. The vulnerability enables attackers to access sensitive system files, configuration data, and potentially other applications running on the same server. This represents a severe risk to organizations relying on the Phpkobo Address Book Script, as it provides a direct pathway for unauthorized system access. The attack surface is particularly concerning given that the vulnerability affects a common web application component and can be exploited without requiring authentication or specialized tools beyond basic web browser capabilities.
Mitigation strategies for this vulnerability must address both the immediate security flaw and the underlying configuration issues that enable exploitation. Organizations should immediately disable the problematic file inclusion functionality or implement robust input validation that prevents directory traversal sequences from being processed. The most effective immediate fix involves sanitizing all user inputs through proper parameter validation, implementing whitelist-based approaches for language code selection, or using secure file inclusion methods that prevent path manipulation. System administrators should also ensure that magic_quotes_gpc is properly configured or implement alternative protection mechanisms such as input filtering libraries or web application firewalls. Additionally, the application should be upgraded to a patched version that addresses the directory traversal vulnerability, and regular security assessments should be conducted to identify similar weaknesses in other components of the application stack. The remediation approach aligns with ATT&CK technique T1059.007 for command and scripting interpreter, as successful exploitation would likely involve executing malicious code through the compromised file inclusion mechanism, and T1213.002 for data from information repositories, as attackers would seek to access sensitive system files and configuration data through this vulnerability.