PT-2009-5899 · Sahana · Sap Hana

Ke4Qqq · Published 2009-10-26 · Updated 2023-02-13 · CVE-2009-3625

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sahana version 0.6.2.2

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter of the www/index.php file. This is a directory traversal vulnerability.

Recommendations For Sahana version 0.6.2.2, consider restricting access to the mod parameter in the www/index.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the mod parameter with untrusted input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-3625

Affected Products

Sap Hana

References · 9

• 🔥 https://exploit-db.com/exploits/33308 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3625 · Security Note
• http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/www/index.php?r1=1.83&r2=1.84 · Patch
• http://openwall.com/lists/oss-security/2009/10/22/3 · Patch
• http://openwall.com/lists/oss-security/2009/10/22/6 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=530255 · Patch
• http://securityfocus.com/bid/36826 · Note
• https://fedorahosted.org/rel-eng/ticket/2635 · Note
• http://sourceforge.net/mailarchive/forum.php?thread_name=5d9043b70910191044l4bb0178fs563a5128a0f5db01%40mail.gmail.com&forum_name=sahana-maindev · Note