PT-2009-5011 · Myf · Myfusion
Cracker
·
Published
2009-07-27
·
Updated
2017-09-19
·
CVE-2009-2611
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
MyFusion (aka MyF) version 6 Beta
Description
A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by exploiting the
settings[locale] parameter with a .. (dot dot) when register globals is enabled.Recommendations
For MyFusion (aka MyF) version 6 Beta, consider disabling the
register globals setting to mitigate the risk of exploitation. Additionally, restrict access to the infusions/last seen users panel/last seen users panel.php file until a patch is available. Avoid using the settings[locale] parameter with untrusted input in the affected file.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Myfusion