PT-2009-4629 · Fuzzylime · Fuzzylime

Staker · Published 2009-06-23 · Updated 2017-09-29 · CVE-2009-2177

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fuzzylime (cms) versions 3.03a and earlier

Description The issue allows remote attackers to conduct directory traversal attacks and overwrite arbitrary files. This is achieved by providing a "....//" (dot dot) in the s parameter, which is then collapsed into a "../" value, enabling the attacker to traverse directories and potentially overwrite files. This issue is specifically relevant when magic quotes gpc is disabled.

Recommendations For versions 3.03a and earlier, consider disabling the s parameter in the code/display.php file until a patch is available, or ensure that magic quotes gpc is enabled to mitigate the risk of directory traversal attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-2177

Affected Products

Fuzzylime

References · 6

• 🔥 https://exploit-db.com/exploits/8978 · Exploit
• 🔥 http://securityfocus.com/bid/35418 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2177 · Security Note
• http://secunia.com/advisories/35489 · Vendor Advisory
• http://osvdb.org/55184 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51206 · Note