CVE-2011-0518 — AI Deep Analysis Summary

🚨 **Essence**: Directory Traversal & RCE in LotusCMS Fraise 3.0. 📉 **Consequences**: Attackers can read/execute arbitrary local files via the `system` parameter in `index.php`.…

🛡️ **Root Cause**: Improper input validation in `core/lib/router.php`. 🐛 **Flaw**: Allows path traversal characters to bypass security checks.…

🎯 **Target**: LotusCMS Fraise. 📦 **Version**: 3.0. 📂 **Component**: `core/lib/router.php` and `index.php`. 🏢 **Vendor**: n/a (Open Source CMS).

🕵️ **Hackers Can**: Include and execute **arbitrary local files**. 💻 **Privileges**: Remote Code Execution (RCE). 📄 **Data**: Access sensitive system files, configs, or source code.…

🔓 **Auth**: No authentication required (Remote). ⚙️ **Config**: High threshold? Only if `magic_quotes_gpc` is **disabled**. ✅ **Ease**: If config is default/off, exploitation is trivial via URL parameters.

🔥 **Public Exp**: YES. 📜 **Sources**: Exploit-DB #15964. 🧪 **PoC**: Nuclei templates available. 🌐 **Status**: Wild exploitation possible via `page` parameter injection (eval call).

🔍 **Check**: Scan for LotusCMS Fraise 3.0. 🧪 **Test**: Send crafted `system` parameter to `index.php`. 📡 **Tools**: Use Nuclei or manual HTTP requests. 👀 **Indicator**: Look for file content leakage in response.

📅 **Published**: Jan 20, 2011. 🛠️ **Patch**: Update to patched version (if available). 🚫 **Note**: Data implies legacy vulnerability; official patch status not explicitly detailed, but advisory exists (ADV-2011-0073).

🛡️ **Workaround 1**: Enable `magic_quotes_gpc` (Deprecated/Not recommended). 🚫 **Workaround 2**: Block access to `index.php` with specific parameters via WAF.…

🔴 **Priority**: HIGH (Historical but Critical). ⏳ **Urgency**: If legacy system is still running, patch NOW. 📉 **Risk**: Low CVSS vector provided, but RCE impact is Max.…