CVE-2012-0981

This bug is like leaving a “folder name” door open in a website URL. An attacker can trick phpShowtime into showing them folder contents and image files you didn’t intend to share publicly. The key point is that it doesn’t require a username or password, and it happens over the network.

This matters if you run phpShowtime 2.0 and it is reachable from the internet (the vulnerability is reachable in the default configuration). It’s most relevant when the app can be accessed publicly through index.php with an r parameter, because attackers can manipulate that value to browse folders and retrieve images. If phpShowtime is not publicly reachable, the risk is greatly reduced.

Treat this as an urgent patch, because it can be used remotely without any login and is confirmed to work for attackers to browse directories and view image files. Since it’s reachable in the default configuration, exposure can happen quickly once the app is discoverable. Patch it as soon as you can and block public access if you can’t upgrade immediately.

1. Identify exposure

   • Verify whether phpShowtime 2.0 is installed and running on any internet-facing host.
   • Confirm that index.php is publicly reachable and that URLs use an r parameter (for example, index.php?r=...).

2. Check for direct vulnerability signals (non-destructive)

   • From a safe test environment or via a controlled security check, look for whether changing r to include “dot dot” path traversal patterns returns directory listings or image contents.
   • Do not test broadly on production if it could reveal private content; the safer approach is to go straight to patching and access restriction.

3. Upgrade to the fixed version

   • Apply the vendor remediation for CVE-2012-0981 by updating phpShowtime using the guidance tied to Secunia advisory 47802.
   • If phpShowtime is used behind a packaged distribution, update using the vendor’s fixed package for that advisory.

4. Workaround if you cannot upgrade right away

   • Restrict access so the public internet cannot reach phpShowtime directly (IP allow-listing, VPN-only access, or a reverse proxy rule that blocks public access).
   • Ensure only trusted users/systems can access the application.

5. After patching

   • Confirm the updated phpShowtime is serving content normally.
   • Review web server access logs for unusual requests to index.php with r-like parameters, especially requests containing “../” patterns.

6. Ongoing monitoring

   • Keep monitoring logs for repeated traversal-like parameter patterns and unexpected directory listing responses.

Severity is reported as MEDIUM (CVSS 5) with network attack access and no authentication required. The weakness is CWE-22 (path traversal). Mechanism: an attacker supplies crafted path segments in the r parameter to index.php, using ../ (dot dot) style traversal to cause phpShowtime to access and reveal server directories and specific image files. Exploitation notes: public exploit code exists (at least one known), and the vulnerability is reachable in the default configuration, meaning public exposure is plausible when the app is internet-facing. KEV is not listed, so there is no CISA KEV confirmation in the findings provided.