CVE-2008-6551

CVE-2008-6551 describes multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier versions, specifically when the magic_quotes_gpc PHP setting is disabled. This flaw allows remote attackers to include and execute arbitrary local files on the server. The vulnerabilities can be exploited via a crafted adminlang cookie or through the 'module' parameter in various administrative scripts within the CMS. The vulnerability has a CVSS score of 5.1, indicating a medium severity. It requires high attack complexity (AC:H) but can be exploited remotely without authentication (AV:N/Au:N), leading to partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). The EPSS score is low, suggesting a low probability of exploitation in the wild. While there is no evidence of active exploitation or inclusion in the CISA KEV catalog, exploit code is publicly available on ExploitDB (EDB-7031). Despite the availability of exploit code, there is no recorded community discussion or media coverage surrounding this CVE, indicating a lack of widespread attention or exploitation.