title: CVE-2010-5278 Exploitation Attempt
id: a4a899e8-fd7a-49dd-b5a8-7044def72d61
author: Subhash Popuri (@pbssubhash)
date: 2021/08/25
status: experimental
description: MODx manager - Local File Inclusion:Directory traversal vulnerability
  in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and
  possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to
  read arbitrary files via a .. (dot dot) in the class_key parameter.
references:
  - https://github.com/projectdiscovery/nuclei-templates
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains:
      - /manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00
  condition: selection
falsepositives:
  - Scanning from Nuclei
  - Unknown
tags:
  - attack.initial_access
  - attack.t1190
level: critical
