CVE-2008-4526

CVE-2008-4526 describes multiple directory traversal vulnerabilities in CCMS 3.1, affecting customcms and ccms products. Attackers can exploit this by manipulating the 'skin' parameter in various PHP files (e.g., index.php, admin.php) to include and execute arbitrary local files. This vulnerability carries a critical CVSS score of 10.0, indicating a high-impact attack with full confidentiality, integrity, and availability compromise, requiring no authentication and low attack complexity. While not on the KEV catalog or Hot List, an ExploitDB entry (EDB-6663) exists, demonstrating proof-of-concept code, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.