CVE-2012-6038 json
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which…
published 2012-11-26 13 y ago modified 2026-06-16 4 mo ago also EUVD-2012-5912
- cvss
- 6.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 1
- Exploit-DB
Summary
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which allows remote authenticated users to read, edit, rename, move, copy and delete files via the (1) dir parameter in a fileman or (2) filemanview action. NOTE: this issue has been referred to as a "path traversal."
Patch / fix
Timeline
- First public exploit (EDB-18344)
- Published
Exploit prediction
2.71% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-18344 RazorCMS 1.2 - Directory Traversal webapps, 2012-01-10
- securityfocus.com http://www.securityfocus.com/bid/51344 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
razorcms.co.uk
/archive/core/old/razorCMS_core_v1_2_1_STABLE.zip
patch
-
exploit-db.com
/exploits/18344
exploit
-
securityfocus.com
/bid/51344
vdb-entry, exploit
-
secunia.com
/advisories/47461
third-party-advisory, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/72268
vdb-entry
-
osvdb.org
/78230
vdb-entry
Sources
- CVE List CVE-2012-6038
- NVD CVE-2012-6038
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.