PT-2009-6052 · Gencms · Gencms

Elwaux · Published 2009-10-28 · Updated 2017-09-19 · CVE-2009-3825

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GenCMS version 2006

Description The issue concerns directory traversal vulnerabilities that allow remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in specific parameters. For example, the p parameter to "show.php" and the Template parameter to "admin/pages/SiteNew.php" are vulnerable.

Recommendations For GenCMS version 2006, as a temporary workaround, consider restricting access to the "show.php" and "admin/pages/SiteNew.php" scripts until a patch is available. Avoid using the p parameter in "show.php" and the Template parameter in "admin/pages/SiteNew.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-3825

Affected Products

Gencms

References · 4

• 🔥 https://exploit-db.com/exploits/9103 · Exploit
• 🔥 http://exploit-db.com/exploits/9103 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3825 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51653 · Note