PT-2009-5936 · Nullam · Nullam Blog

Drosophila + 1 · Published 2009-10-11 · Updated 2018-10-10 · CVE-2009-3664

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nullam Blog version 0.1.2

Description The issue concerns multiple directory traversal vulnerabilities in the index.php file. These vulnerabilities allow remote attackers to include or execute arbitrary files by utilizing a .. (dot dot) in the p and s parameters.

Recommendations For Nullam Blog version 0.1.2, consider restricting access to the p and s parameters in the index.php file to prevent directory traversal attacks. As a temporary workaround, restrict the use of the p and s parameters until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-3664

Affected Products

Nullam Blog

References · 7

• 🔥 https://exploit-db.com/exploits/9625 · Exploit
• 🔥 http://exploit-db.com/exploits/9625 · Exploit
• 🔥 http://osvdb.org/57919 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3664 · Security Note
• http://secunia.com/advisories/36648 · Vendor Advisory
• http://securityfocus.com/archive/1/506380/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53217 · Note