PT-2009-4628 · Fuzzylime · Fuzzylime

Staker · Publicado 2009-06-23 · Atualizado 2017-09-29 · CVE-2009-2176

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fuzzylime (cms) versions 3.03a and earlier

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences. This can be achieved by exploiting the list parameter to the "code/confirm.php" endpoint and the template parameter to the "code/display.php" endpoint when magic quotes gpc is disabled.

Recommendations For versions 3.03a and earlier, consider disabling the execution of files from user-supplied input to code/confirm.php and code/display.php until a patch is available. Restrict access to the list and template parameters in these endpoints to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-2176

Produtos afetados

Fuzzylime

Referências · 7

• 🔥 https://exploit-db.com/exploits/8978 · Exploit
• 🔥 http://securityfocus.com/bid/35418 · Exploit
• http://osvdb.org/55183 · Nota
• http://osvdb.org/55182 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2176 · Nota de Segurança
• http://secunia.com/advisories/35489 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51205 · Nota