PT-2009-5899 · Sahana · Sap Hana

Ke4Qqq · Publicado 2009-10-26 · Atualizado 2023-02-13 · CVE-2009-3625

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sahana version 0.6.2.2

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter of the www/index.php file. This is a directory traversal vulnerability.

Recommendations For Sahana version 0.6.2.2, consider restricting access to the mod parameter in the www/index.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the mod parameter with untrusted input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-3625

Produtos afetados

Sap Hana

Referências · 9

• 🔥 https://exploit-db.com/exploits/33308 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3625 · Nota de Segurança
• http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/www/index.php?r1=1.83&r2=1.84 · Correção
• http://openwall.com/lists/oss-security/2009/10/22/3 · Correção
• http://openwall.com/lists/oss-security/2009/10/22/6 · Correção
• http://securityfocus.com/bid/36826 · Nota
• https://fedorahosted.org/rel-eng/ticket/2635 · Nota
• http://sourceforge.net/mailarchive/forum.php?thread_name=5d9043b70910191044l4bb0178fs563a5128a0f5db01%40mail.gmail.com&forum_name=sahana-maindev · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=530255 · Correção