PT-2009-4213 · Dm · File Manager

Snakespc · Published 2009-05-20 · Updated 2017-09-29 · CVE-2009-1741

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: DM FileManager version 3.9.2

Description: The issue concerns SQL injection vulnerabilities in the login.php file of DM FileManager. When magic quotes gpc is disabled, remote attackers can execute arbitrary SQL commands by manipulating the Username and Password fields.

Recommendations: For DM FileManager version 3.9.2, consider disabling the login functionality in login.php until a patch is available, or enable magic quotes gpc to mitigate the risk of SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-1741

Affected Products

File Manager

References · 5

• 🔥 http://securityfocus.com/bid/35035 · Exploit
• 🔥 https://exploit-db.com/exploits/8741 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1741 · Security Note
• http://secunia.com/advisories/35167 · Vendor Advisory
• http://osvdb.org/54597 · Note