CVE-2018-25439 in MetInfo
Summary
by MITRE • 10/22/2026
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
MetInfo CMS version 6.0.0 prior to release 6.1.1 is affected by a critical path traversal vulnerability located within the /include/thumb.php script. This flaw stems from insufficient validation and sanitization of user-supplied input, specifically targeting the dir parameter used for specifying directory paths during image thumbnail generation operations. The underlying technical mechanism involves a flawed attempt to sanitize input where developers relied on a str_replace function to strip out dangerous path traversal sequences such as ../ or ..\ before processing the file path. However, this sanitization logic is bypassable through specific encoding techniques and character sequence manipulation that exploit how the server-side operating system interprets backslashes versus forward slashes in file paths.
The operational impact of this vulnerability allows unauthenticated remote attackers to read arbitrary files from the web server's filesystem with the privileges of the application process. By crafting HTTP requests containing carefully constructed dir parameters, an attacker can traverse up directory levels and access sensitive configuration files that are not intended for public exposure. A primary target in such attacks is the database configuration file, typically named config_db.php on Windows systems or similar variants like config.inc.php on Linux environments. Accessing these files reveals critical credentials including database hostnames, usernames, passwords, and potentially application encryption keys, which can lead to full system compromise if combined with other exploitation techniques.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The failure to properly canonicalize or strictly validate the input against an allowlist of permitted directories constitutes this classic weakness. Furthermore, from a threat intelligence perspective, the exploitation pattern corresponds to ATT&CK technique T1083: File and Directory Discovery, where adversaries probe the system structure to locate sensitive data for subsequent exfiltration or lateral movement. The presence of backslash bypass techniques highlights a common pitfall in cross-platform web application development where developers may not account for how different operating systems handle path separators differently during file I/O operations.
Evidence of active exploitation was first documented by the Shadowserver Foundation on October 14, 2023, indicating that this vulnerability is being actively targeted in the wild. Organizations running MetInfo CMS versions earlier than 6.1.1 are strongly advised to upgrade immediately to mitigate this risk. In cases where immediate patching is not feasible due to compatibility constraints or deployment complexities, administrators should implement web application firewall rules designed to detect and block requests containing path traversal sequences within the dir parameter of thumb.php endpoints. Additionally, restricting file permissions on configuration files so that they are unreadable by the web server process can serve as a compensating control to limit the impact even if exploitation occurs.