PT-2009-6547 · Ignition · Ignition

Condemned · Published 2009-12-28 · Updated 2017-08-17 · CVE-2009-4426

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ignition version 1.2

Description The issue concerns multiple directory traversal vulnerabilities. When magic quotes gpc is disabled, remote attackers can include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the blog parameter to specific API endpoints, such as "comment.php" and "view.php".

Recommendations For Ignition version 1.2, consider disabling the execution of files from user-inputted paths until a patch is available. Restrict access to the "comment.php" and "view.php" endpoints to minimize the risk of exploitation. Avoid using the blog parameter in these endpoints until the issue is resolved. Enable magic quotes gpc to prevent attackers from injecting malicious input.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-4426

Affected Products

Ignition

References · 8

• 🔥 http://packetstormsecurity.org/0912-exploits/ignition-lfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/10569 · Exploit
• 🔥 http://osvdb.org/61225 · Exploit
• 🔥 http://exploit-db.com/exploits/10569 · Exploit
• 🔥 http://osvdb.org/61226 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4426 · Security Note
• http://secunia.com/advisories/37836 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54940 · Note