PT-2009-5799 · Cmsphp · Cmsphp

Sirgod · Publicado 2009-10-01 · Atualizado 2017-09-19 · CVE-2009-3507

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CMSphp version 0.21

Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the mod file parameter of the modules.php file.

Recommendations For CMSphp version 0.21, consider restricting access to the modules.php file or the mod file parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the mod file parameter with untrusted input.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-3507

Produtos afetados

Cmsphp

Referências · 4

• 🔥 http://exploit-db.com/exploits/9311 · Exploit
• 🔥 https://exploit-db.com/exploits/9311 · Exploit
• http://secunia.com/advisories/36075 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3507 · Nota de Segurança