PT-2009-4534 · Phpwebthings · Phpwebthings

Br0Ly · Published 2009-06-16 · Updated 2017-09-29 · CVE-2009-2081

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpWebThings versions 1.5.2 and earlier

Description The issue allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in the help.php file when magic quotes gpc is disabled.

Recommendations For phpWebThings versions 1.5.2 and earlier, consider disabling the help.php file or restricting access to it until a patch is available. Avoid using the module parameter in the help.php file with untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-2081

Affected Products

Phpwebthings

References · 3

• 🔥 https://exploit-db.com/exploits/8928 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2081 · Security Note
• http://securityfocus.com/bid/35313 · Note