PT-2009-5826 · Clear Content · Clear Content

Mizoz · Published 2009-10-02 · Updated 2017-09-19 · CVE-2009-3535

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Clear Content version 1.1

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. (dot dot) in the url parameter of the image.php file.

Recommendations For Clear Content version 1.1, consider restricting access to the image.php file until a patch is available, or apply configuration changes to prevent directory traversal attacks, such as validating and sanitizing the url parameter to prevent the inclusion of malicious input.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-3535

Affected Products

Clear Content

References · 7

• 🔥 http://exploit-db.com/exploits/9089 · Exploit
• 🔥 https://exploit-db.com/exploits/9089 · Exploit
• 🔥 http://osvdb.org/55742 · Exploit
• 🔥 http://packetstormsecurity.org/0907-exploits/clearcontent-rfilfi.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3535 · Security Note
• http://secunia.com/advisories/35726 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51629 · Note