PT-2009-5148 · Dit.Cms · It!Cms

Sirgod · Published 2009-08-17 · Updated 2017-09-19 · CVE-2009-2784

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dit.cms version 1.3

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal vulnerabilities. This can be achieved by exploiting the path parameter to index.php in various directories, the sitemap parameter to index.php in certain menus, and the relPath parameter to index/index.php. The vulnerabilities are exploitable when register globals is enabled.

Recommendations For dit.cms version 1.3, consider disabling the register globals setting to mitigate the risk of exploitation. Additionally, restrict access to the vulnerable index.php files in the affected directories and menus, and avoid using the path, sitemap, and relPath parameters until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-2784

Affected Products

It!Cms

References · 4

• 🔥 http://exploit-db.com/exploits/9310 · Exploit
• 🔥 https://exploit-db.com/exploits/9310 · Exploit
• http://secunia.com/advisories/36076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2784 · Security Note