CVE-2004-2255

Vulnerability

The vulnerability is a directory traversal in phpMyFAQ version 1.3.12. The action variable is used as part of a template filename, allowing an attacker to include path traversal sequences to read arbitrary files on the server [1].

Exploitation

An attacker can exploit this by sending a crafted request with path traversal sequences in the action parameter. No authentication is required as the vulnerability is remotely accessible [1]. The attack vector is HTTP GET request to the phpMyFAQ application.

Impact

Successful exploitation allows remote attackers to read arbitrary files from the server, and potentially execute local PHP files if they can be uploaded or exist in traversable directories. This could lead to information disclosure and possible remote code execution [1].

Mitigation

The vendor released an update; users should upgrade to phpMyFAQ 1.4.0 or later. The Secunia advisory [1] provides details. No other workarounds are mentioned.