PT-2009-3219 · Flatnux · Flatnux Cms

Alfons Luja · Published 2009-02-13 · Updated 2018-10-10 · CVE-2009-0572

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FlatnuX CMS (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled and magic quotes gpc is disabled. This can be achieved by providing a URL in the FNROOTPATH parameter to specific API endpoints, such as "index.php" and "filemanager.php".

Recommendations For all affected versions, ensure register globals is disabled and magic quotes gpc is enabled to prevent exploitation. As a temporary workaround, consider restricting access to the "index.php" and "filemanager.php" endpoints until the issue is resolved. Avoid using the FNROOTPATH parameter in these endpoints until the issue is fixed.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0572

Affected Products

Flatnux Cms

References · 8

• 🔥 http://securityfocus.com/bid/33599 · Exploit
• 🔥 https://exploit-db.com/exploits/7969 · Exploit
• http://secunia.com/advisories/33721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0572 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48491 · Note
• http://securityfocus.com/archive/1/500663/100/0/threaded · Note
• http://osvdb.org/51729 · Note
• http://osvdb.org/51728 · Note