CVE:CVE-2008-2840
CNNVD:CNNVD-200806-334
Exero CMS 1.0.0 和1.0.1中存在多个目录遍历漏洞，远程攻击者通过对(1) custompage.php, (2) errors/404.php, (3) members/memberslist.php, (4) members/profile.php, (5) news/fullview.php, (6) news/index.php, (7) nopermission.php, (8) usercp/avatar.php, 或 (9) themes/Default/中的usercp/editpassword.php的主体参数中的一个.. (dot dot)，以包含和执行任意代码。
solution:Upgrade exerocms exero_cms to a higher version than 1.0.0,1.0.1,and avoid the version 1.0.0,1.0.1