PT-2009-6556 · F3Site · F3Site

Publicado 2009-12-28 · Atualizado 2017-08-17 · CVE-2009-4435

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F3Site 2009

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to include and execute arbitrary local files. The attack is facilitated through directory traversal sequences in the GLOBALS[nlang] parameter to specific API endpoints: "/mod/poll.php" and "/mod/new.php".

Recommendations For F3Site 2009, to mitigate the issue, consider restricting access to the GLOBALS[nlang] parameter in the affected API endpoints "/mod/poll.php" and "/mod/new.php" until a fix is available. Additionally, avoid using directory traversal sequences in these parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-4435

Produtos afetados

F3Site

Referências · 8

• 🔥 http://securityfocus.com/bid/37408 · Exploit
• 🔥 http://exploit-db.com/exploits/10536 · Exploit
• 🔥 https://exploit-db.com/exploits/33420 · Exploit
• 🔥 http://packetstormsecurity.org/0912-exploits/f3site2009-lfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33419 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4435 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4435 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54908 · Nota