PT-2009-4629 · Fuzzylime · Fuzzylime

Staker · Publicado 2009-06-23 · Atualizado 2017-09-29 · CVE-2009-2177

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fuzzylime (cms) versions 3.03a and earlier

Description The issue allows remote attackers to conduct directory traversal attacks and overwrite arbitrary files. This is achieved by providing a "....//" (dot dot) in the s parameter, which is then collapsed into a "../" value, enabling the attacker to traverse directories and potentially overwrite files. This issue is specifically relevant when magic quotes gpc is disabled.

Recommendations For versions 3.03a and earlier, consider disabling the s parameter in the code/display.php file until a patch is available, or ensure that magic quotes gpc is enabled to mitigate the risk of directory traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-2177

Produtos afetados

Fuzzylime

Referências · 6

• 🔥 https://exploit-db.com/exploits/8978 · Exploit
• 🔥 http://securityfocus.com/bid/35418 · Exploit
• http://osvdb.org/55184 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51206 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2177 · Nota de Segurança
• http://secunia.com/advisories/35489 · Aviso do Fabricante