Vulnerability · Published Jul 16, 2025 · Assigned by VulnCheck
CVE-2025-34126RIPS Scanner v0.54 Path Traversal
High 8.7
In plain English
A high-severity path traversal in RIPS Scanner from RIPS Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the privileges of the web server by sending crafted HTTP GET requests to the 'windows/code.php' script with a manipulated 'file' parameter. This can lead to disclosure of sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RIPS Technologies | RIPS Scanner | 0.54 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://codesec.blogspot.com/2015/03/rips-scanner-v-054-local-file-include.html third-party-advisory, exploit
- https://www.exploit-db.com/exploits/18660 exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/rips_traversal.rb exploit
- https://rips-scanner.sourceforge.net/ product
- https://www.vulncheck.com/advisories/rips-scanner-path-traversal third-party-advisory