CVE-2008-7064
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1...
CVE-2008-7064 is a high vulnerability (CVSS 7.5) in Quicksilver Forums Forums, published August 25, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.19%, the 88th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 3.19%EPSS, 88th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Quicksilver Forums 1.4.2 (Windows) - Remote Code Execution | 2008-11-24 |
What each source reports
NVD Score used
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
- Record
CVE-2008-7064- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
- Record
CVE-2008-7064- Updated
- 2026-11-02
EUVDEUVD-2008-7023No score
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
- Record
EUVD-2008-7023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q6qj-8c3q-5gw5No score
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1...
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
- Record
GHSA-q6qj-8c3q-5gw5- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.