PT-2009-4628 · Fuzzylime · Fuzzylime

Staker · Published 2009-06-23 · Updated 2017-09-29 · CVE-2009-2176

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fuzzylime (cms) versions 3.03a and earlier

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences. This can be achieved by exploiting the list parameter to the "code/confirm.php" endpoint and the template parameter to the "code/display.php" endpoint when magic quotes gpc is disabled.

Recommendations For versions 3.03a and earlier, consider disabling the execution of files from user-supplied input to code/confirm.php and code/display.php until a patch is available. Restrict access to the list and template parameters in these endpoints to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-2176

Affected Products

Fuzzylime

References · 7

• 🔥 https://exploit-db.com/exploits/8978 · Exploit
• 🔥 http://securityfocus.com/bid/35418 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2176 · Security Note
• http://secunia.com/advisories/35489 · Vendor Advisory
• http://osvdb.org/55183 · Note
• http://osvdb.org/55182 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51205 · Note