Path Traversal in MetInfo CMS File Inclusion

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

MetInfo CMS versions 6.0.0 through 6.1.0 contain a critical path traversal vulnerability (CWE-22) in the /include/thumb.php endpoint that allows unauthenticated attackers to read arbitrary files from affected servers. The vulnerability exploits insufficient input validation on the 'dir' parameter, where a basic str_replace filter fails to account for alternative path traversal sequences—particularly backslash notation on Windows systems. This flaw is significant because it enables direct access to sensitive configuration files like config_db.php, which typically contain database credentials and other secrets. Any organization running vulnerable MetInfo CMS instances is at immediate risk, especially those exposed to the internet without additional access controls.

Casky's 351 mapped skills leverage Claude's reasoning capabilities to detect the reconnaissance and resource access patterns associated with this CVE across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0007 (Discovery). Practitioners using Casky would identify suspicious HTTP requests to /include/thumb.php containing directory traversal patterns in the 'dir' parameter—including encoded backslashes, double-encoded sequences, or null byte injections that attempt to escape intended directory restrictions. The platform's skills would flag requests attempting to access config files outside the intended directory structure, correlating these patterns with known path traversal exploitation signatures. Security teams would see findings highlighting the abuse of file inclusion mechanisms for sensitive data exposure, enabling rapid detection of active exploitation attempts against their MetInfo installations before attackers exfiltrate database credentials or other critical configuration data.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25439.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2018-25439

Casky has 351 skills that investigate the attack patterns behind CVE-2018-25439. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn