PT-2009-6264 · Php · Php Traverser

Published 2009-11-27 · Updated 2017-08-17 · CVE-2009-4085

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Traverser version 0.8.0

Description A remote file inclusion issue exists, allowing remote attackers to execute arbitrary PHP code via a URL in the BASE parameter within the GLOBALS array. This can be achieved by manipulating the URL to include malicious PHP code.

Recommendations For PHP Traverser version 0.8.0, consider restricting access to the mp3 id.php file in the assets/plugins/mp3 id directory to minimize the risk of exploitation. As a temporary workaround, avoid using the BASE parameter in the GLOBALS array until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-4085

Affected Products

Php Traverser

References · 5

• 🔥 https://exploit-db.com/exploits/10219 · Exploit
• http://secunia.com/advisories/37455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4085 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54378 · Note
• http://osvdb.org/60466 · Note