PT-2009-4534 · Phpwebthings · Phpwebthings

Br0Ly · Publicado 2009-06-16 · Atualizado 2017-09-29 · CVE-2009-2081

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpWebThings versions 1.5.2 and earlier

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in the help.php file when magic quotes gpc is disabled.

Recommendations For phpWebThings versions 1.5.2 and earlier, consider disabling the help.php file or restricting access to it until a patch is available. Avoid using the module parameter in the help.php file with untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-2081

Produtos afetados

Phpwebthings

Referências · 3

• 🔥 https://exploit-db.com/exploits/8928 · Exploit
• http://securityfocus.com/bid/35313 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2081 · Nota de Segurança