CVE-2024-42718 Details

A path traversal vulnerability has been identified in Croogo CMS version 4.0.7. This vulnerability allows authenticated remote attackers to read arbitrary files by exploiting the 'edit-file' parameter with a crafted path. The issue arises from insufficient validation of user input, enabling attackers to traverse directories and access files outside the web root, such as the sensitive '/etc/passwd' file.

To address this vulnerability, Croogo CMS should implement stricter input validation and sanitization to prevent path traversal attacks. Access controls should be applied to restrict unauthorized users from accessing sensitive files. Additionally, web server configurations should be reviewed to ensure that critical system files are not accessible through the web server.