PT-2009-6556 · F3Site · F3Site

Published 2009-12-28 · Updated 2017-08-17 · CVE-2009-4435

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F3Site 2009

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to include and execute arbitrary local files. The attack is facilitated through directory traversal sequences in the GLOBALS[nlang] parameter to specific API endpoints: "/mod/poll.php" and "/mod/new.php".

Recommendations For F3Site 2009, to mitigate the issue, consider restricting access to the GLOBALS[nlang] parameter in the affected API endpoints "/mod/poll.php" and "/mod/new.php" until a fix is available. Additionally, avoid using directory traversal sequences in these parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-4435

Affected Products

F3Site

References · 8

• 🔥 http://securityfocus.com/bid/37408 · Exploit
• 🔥 http://exploit-db.com/exploits/10536 · Exploit
• 🔥 https://exploit-db.com/exploits/33420 · Exploit
• 🔥 http://packetstormsecurity.org/0912-exploits/f3site2009-lfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/33419 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4435 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4435 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54908 · Note