PT-2009-4603 · Adaptweb · Adaptweb
Sirgod
·
Published
2009-06-22
·
Updated
2017-09-29
·
CVE-2009-2151
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
AdaptWeb version 0.9.2
Description
The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the index.php file. This is achieved by using a .. (dot dot) in the
newlang parameter of the affected API endpoint.Recommendations
For AdaptWeb version 0.9.2, consider restricting access to the
newlang parameter in the index.php file to minimize the risk of exploitation. Avoid using the newlang parameter with unvalidated input until the issue is resolved.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Adaptweb