PT-2009-3946 · Webportal · Webportal Cms

Ahmadbady · Publicado 2009-04-27 · Atualizado 2017-09-29 · CVE-2009-1445

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebPortal CMS version 0.8-beta

Description The issue concerns directory traversal vulnerabilities. Remote attackers can read arbitrary files by using directory traversal sequences in the lang parameter to "libraries/helpdocs/help.php" API endpoint. Additionally, attackers can include and execute arbitrary local files via directory traversal sequences in the error parameter to "index.php" API endpoint.

Recommendations For WebPortal CMS version 0.8-beta, consider restricting access to the lang parameter in the "libraries/helpdocs/help.php" API endpoint and the error parameter in the "index.php" API endpoint to minimize the risk of exploitation. Avoid using these parameters until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-1445

Produtos afetados

Webportal Cms

Referências · 5

• 🔥 http://securityfocus.com/bid/34687 · Exploit
• 🔥 https://exploit-db.com/exploits/8516 · Exploit
• http://osvdb.org/54119 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1445 · Nota de Segurança
• http://osvdb.org/54120 · Nota