PT-2009-3895 · Mozilo · Mozilocms

Sirgod · Published 2009-04-22 · Updated 2017-09-29 · CVE-2009-1369

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions moziloCMS version 1.11

Description The issue allows remote attackers to obtain sensitive information. This can be achieved via several parameters, including the gal[] parameter to "gallery.php", the page[] and cat[] parameters to "index.php", or the file[] parameter to "download.php". These parameters can reveal the installation path in an error message.

Recommendations For moziloCMS version 1.11, consider restricting access to the vulnerable parameters gal[], page[], cat[], and file[] in their respective scripts until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints "gallery.php", "index.php", and "download.php" to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-1369

Affected Products

Mozilocms

References · 3

• 🔥 https://exploit-db.com/exploits/8394 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1369 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49811 · Note