PT-2009-3353 · Papoo · Papoo Cms

Sirgod · Published 2009-02-25 · Updated 2017-09-29 · CVE-2009-0735

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Papoo CMS version 3.6

Description The issue allows remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the pfadhier parameter, specifically when register globals is enabled and magic quotes gpc is disabled.

Recommendations For Papoo CMS version 3.6, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the pfadhier parameter in the affected API endpoint to minimize the risk of file traversal attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-0735

Affected Products

Papoo Cms

References · 4

• 🔥 https://exploit-db.com/exploits/8030 · Exploit
• 🔥 http://securityfocus.com/bid/33718 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0735 · Security Note
• http://secunia.com/advisories/33911 · Vendor Advisory