CVE-2012-1617

CVE-2012-1617 describes a directory traversal vulnerability in combine.php within OSClass versions prior to 2.3.6, specifically affecting the "juan_ramon osclass" product. This flaw allows remote, unauthenticated attackers to read and write arbitrary files on the server by manipulating the "type" parameter with dot-dot-slash sequences, which can be leveraged for arbitrary file uploads. The vulnerability has a CVSS score of 6.4 (Medium), indicating a network-based attack with low complexity, leading to partial confidentiality and integrity impact. While not listed on the KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.