PT-2009-5799 · Cmsphp · Cmsphp

Sirgod · Published 2009-10-01 · Updated 2017-09-19 · CVE-2009-3507

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CMSphp version 0.21

Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the mod file parameter of the modules.php file.

Recommendations For CMSphp version 0.21, consider restricting access to the modules.php file or the mod file parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the mod file parameter with untrusted input.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-3507

Affected Products

Cmsphp

References · 4

• 🔥 http://exploit-db.com/exploits/9311 · Exploit
• 🔥 https://exploit-db.com/exploits/9311 · Exploit
• http://secunia.com/advisories/36075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3507 · Security Note