CVE-2011-4713

Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the _ID parameter to (1) catalog/shopping_cart.php or (2) catalog/content.php.

• CWE-22

• http://forums.oscss.org/2-security/oscss2-id-parameter-local-file-inclusion-t1999.html#p11194
• http://oscss.svn.sourceforge.net/viewvc/oscss?view=revision&revision=3872
• http://seclists.org/fulldisclosure/2011/Nov/117Exploit
• http://secunia.com/advisories/46741Vendor Advisory
• http://www.exploit-db.com/exploits/18099Exploit
• http://www.rul3z.de/advisories/SSCHADV2011-034.txtExploit
• http://www.securityfocus.com/archive/1/520421Exploit
• http://forums.oscss.org/2-security/oscss2-id-parameter-local-file-inclusion-t1999.html#p11194
• http://oscss.svn.sourceforge.net/viewvc/oscss?view=revision&revision=3872
• http://seclists.org/fulldisclosure/2011/Nov/117Exploit
• http://secunia.com/advisories/46741Vendor Advisory
• http://www.exploit-db.com/exploits/18099Exploit
• http://www.rul3z.de/advisories/SSCHADV2011-034.txtExploit
• http://www.securityfocus.com/archive/1/520421Exploit

Published

Dec 8, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4707Multiple cross-site scripting (XSS) vulnerabilities in the V…
• CVE-2011-4708Cross-site scripting (XSS) vulnerability in IBM Rational Ass…
• CVE-2011-4709Multiple cross-site scripting (XSS) vulnerabilities in Hotar…
• CVE-2011-4710Multiple SQL injection vulnerabilities in Pixie CMS 1.01 thr…
• CVE-2011-4711Multiple directory traversal vulnerabilities in namazu.cgi i…
• CVE-2011-4712Directory traversal vulnerability in Oxide WebServer allows …
• CVE-2011-4714Directory traversal vulnerability in Virtual Vertex Muster b…
• CVE-2011-4715Directory traversal vulnerability in cgi-bin/koha/mainpage.p…
• CVE-2011-4716Directory traversal vulnerability in file in DreamBox DM800 …
• CVE-2011-4717Directory traversal vulnerability in zFTPServer Suite 6.0.0.…
• CVE-2011-4718Session fixation vulnerability in the Sessions subsystem in …
• CVE-2011-4719Multiple unspecified vulnerabilities in Google Chrome before…