CVE-2008-2672

CVE-2008-2672 describes multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier versions, specifically when the register_globals setting is enabled. Attackers can exploit this by manipulating the ewiki_id and ewiki_action parameters in fragments/css.php, or potentially the id parameter in the default URI, to include and execute arbitrary local files. This vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry (EDB-5771) exists, and the vulnerability has not garnered significant community discussion or media coverage.