PT-2009-3946 · Webportal · Webportal Cms

Ahmadbady · Published 2009-04-27 · Updated 2017-09-29 · CVE-2009-1445

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebPortal CMS version 0.8-beta

Description The issue concerns directory traversal vulnerabilities. Remote attackers can read arbitrary files by using directory traversal sequences in the lang parameter to "libraries/helpdocs/help.php" API endpoint. Additionally, attackers can include and execute arbitrary local files via directory traversal sequences in the error parameter to "index.php" API endpoint.

Recommendations For WebPortal CMS version 0.8-beta, consider restricting access to the lang parameter in the "libraries/helpdocs/help.php" API endpoint and the error parameter in the "index.php" API endpoint to minimize the risk of exploitation. Avoid using these parameters until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-1445

Affected Products

Webportal Cms

References · 5

• 🔥 http://securityfocus.com/bid/34687 · Exploit
• 🔥 https://exploit-db.com/exploits/8516 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1445 · Security Note
• http://osvdb.org/54119 · Note
• http://osvdb.org/54120 · Note