CVE-2024-11210 in EyouCMS
Summary
by MITRE • 11/14/2024
A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/admin/logic/FilemanagerLogic.php. The manipulation of the argument activepath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This critical vulnerability in EyouCMS 1.51 represents a severe path traversal flaw within the file manager functionality that poses significant security risks to affected systems. The vulnerability exists in the editFile function of the FilemanagerLogic.php file, specifically in how the activepath argument is processed, allowing attackers to manipulate directory traversal sequences and access unauthorized files or directories on the server. This type of vulnerability falls under CWE-22 Path Traversal which is classified as a critical weakness in software applications that handle file operations, particularly when input validation is insufficient for path-related parameters.
The remote exploitability of this vulnerability means that attackers can leverage it without requiring physical access to the system or local network presence, making it particularly dangerous for web applications. The public disclosure of the exploit increases the risk profile significantly as malicious actors can immediately implement attacks against vulnerable installations without needing to develop custom exploitation techniques. This vulnerability enables unauthorized access to sensitive data, potential code execution, and system compromise through directory traversal attacks that can bypass normal file access controls.
The operational impact of this vulnerability extends beyond simple data exposure, as it could enable attackers to modify or delete critical application files, potentially leading to complete system compromise. Attackers may exploit the path traversal mechanism to access configuration files containing database credentials, application secrets, or other sensitive information stored in directories outside the intended web root. The lack of vendor response to early disclosure attempts creates a particularly concerning scenario where affected organizations have no assurance of receiving timely patches or security updates to address this critical weakness.
Organizations running EyouCMS 1.51 should implement immediate mitigations including input validation for all path-related parameters, implementing proper access controls, and restricting file manager functionality to authorized users only. The vulnerability aligns with ATT&CK technique T1083 File and Directory Discovery which describes methods adversaries use to enumerate file systems and identify sensitive data locations. Security measures should include monitoring for suspicious directory traversal attempts, implementing web application firewalls, and ensuring proper file permissions are enforced throughout the application's file system structure. Additionally, organizations should consider upgrading to patched versions of EyouCMS or implementing compensating controls such as restricting PHP execution in upload directories and employing strict input sanitization routines that prevent malicious path sequences from being processed by the application's file handling functions.