PT-2009-5148 · Dit.Cms · It!Cms

Sirgod · Publicado 2009-08-17 · Atualizado 2017-09-19 · CVE-2009-2784

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dit.cms version 1.3

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal vulnerabilities. This can be achieved by exploiting the path parameter to index.php in various directories, the sitemap parameter to index.php in certain menus, and the relPath parameter to index/index.php. The vulnerabilities are exploitable when register globals is enabled.

Recommendations For dit.cms version 1.3, consider disabling the register globals setting to mitigate the risk of exploitation. Additionally, restrict access to the vulnerable index.php files in the affected directories and menus, and avoid using the path, sitemap, and relPath parameters until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-2784

Produtos afetados

It!Cms

Referências · 4

• 🔥 http://exploit-db.com/exploits/9310 · Exploit
• 🔥 https://exploit-db.com/exploits/9310 · Exploit
• http://secunia.com/advisories/36076 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2784 · Nota de Segurança