Miggo Logo
Miggo Vulnerability Database
→
CVE-2015-10030

CVE-2015-10030: SUKOHI Surpass Path Traversal vulnerability

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2015-10030
GHSA ID
GHSA-c9pw-f4wp-22jr
EPSS Score
0.19053%
CWE
CWE-22
Published
1/8/2023
Updated
10/20/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
sukohi/surpasscomposer< 1.0.01.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the dir() method in Surpass.php which handled user-controlled 'dir' parameter. The pre-patch code (line 53) directly assigned $this->_dir = $dir without sanitization. The patch adds str_replace to remove path traversal characters (/ and .), confirming this was the injection point. The CWE-22 classification and commit message explicitly reference directory traversal protection being added to this method.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility **s ***n *oun* in SUKO*I Surp*ss *n* *l*ssi*i** *s *riti**l. T*is vuln*r**ility *****ts unknown *o** o* t** *il* `sr*/Suko*i/Surp*ss/Surp*ss.p*p`. T** m*nipul*tion o* t** *r*um*nt *ir l***s to p*t*n*m* tr*v*rs*l. Up*r**in* to v*rsion

Reasoning

T** vuln*r**ility st*ms *rom t** *ir() m*t*o* in Surp*ss.p*p w*i** **n*l** us*r-*ontroll** '*ir' p*r*m*t*r. T** pr*-p*t** *o** (lin* **) *ir**tly *ssi*n** $t*is->_*ir = $*ir wit*out s*nitiz*tion. T** p*t** ***s str_r*pl*** to r*mov* p*t* tr*v*rs*l **