CVE-2008-2672

Multiple directory traversal vulnerabilities in ErfurtWiki R1.02b and earlier, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) ewiki_id and (2) ewiki_action parameters to fragments/css.php, and possibly the (3) id parameter to the default URI. NOTE: the default URI is site-specific but often performs an include_once of ewiki.php.

• CWE-22

• http://chroot.org/exploits/chroot_uu_007Exploit
• http://securityreason.com/securityalert/3936
• http://www.securityfocus.com/archive/1/493219/100/0/threaded
• http://www.securityfocus.com/bid/29628Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42981
• https://www.exploit-db.com/exploits/5771
• http://chroot.org/exploits/chroot_uu_007Exploit
• http://securityreason.com/securityalert/3936
• http://www.securityfocus.com/archive/1/493219/100/0/threaded
• http://www.securityfocus.com/bid/29628Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42981
• https://www.exploit-db.com/exploits/5771

Published

Jun 12, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-2666Multiple directory traversal vulnerabilities in PHP 5.2.6 an…
• CVE-2008-2667SQL injection vulnerability in the Courier Authentication Li…
• CVE-2008-2668Multiple cross-site scripting (XSS) vulnerabilities in yBlog…
• CVE-2008-2669Multiple SQL injection vulnerabilities in yBlog 0.2.2.2 allo…
• CVE-2008-2670Multiple SQL injection vulnerabilities in index.php in Insan…
• CVE-2008-2671SQL injection vulnerability in comments.php in DCFM Blog 0.9…
• CVE-2008-2673SQL injection vulnerability in index.php in Powie pNews 2.08…
• CVE-2008-2674Unspecified vulnerability in the Interstage Management Conso…
• CVE-2008-2675Cross-site scripting (XSS) vulnerability in index.php in PHP…
• CVE-2008-2676SQL injection vulnerability in the iJoomla News Portal (com_…
• CVE-2008-2677Cross-site scripting (XSS) vulnerability in edit1.php in Tel…
• CVE-2008-2678Multiple SQL injection vulnerabilities in Telephone Director…