PT-2009-4673 · An · An Guestbook

Cracker · Published 2009-06-26 · Updated 2017-09-19 · CVE-2009-2224

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions AN Guestbook version 0.7.8

Description A directory traversal issue exists due to the g lang parameter in ang/shared/flags.php, allowing remote attackers to read arbitrary files when register globals is enabled. This is achieved by using a .. (dot dot) in the g lang parameter.

Recommendations For AN Guestbook version 0.7.8, consider disabling the register globals setting to mitigate the risk of exploitation. Additionally, restrict access to the ang/shared/flags.php file to minimize the risk of arbitrary file reading. Avoid using the g lang parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-2224

Affected Products

An Guestbook

References · 4

• 🔥 http://attrition.org/pipermail/vim/2009-June/002196.html · Exploit
• 🔥 http://exploit-db.com/exploits/9013 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2224 · Security Note
• http://securityfocus.com/bid/35486 · Note