CVE Daily

CVE-2012-10034

ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to impr...

High CVSS 8.7

Overview

ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie parameter. The application fails to sanitize user-supplied input, allowing attackers to traverse directories and read arbitrary files outside the web root. The vulnerability is further exacerbated by null byte injection (%00) to bypass file extension checks.

CWE: CWE-22 Published: 2025-08-05T20:15:34.630
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 8.7 (HIGH)
  • Detected tags: lfi (tag impact: MODERATE)

Recommended actions:

  • Normalize paths, use allowlists; block user-controlled file paths.

Recommended tools

Tags