CVE-2009-2177

Summary

code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to conduct directory traversal attacks and overwrite arbitrary files via a "….//" (dot dot) in the s parameter, which is collapsed into a "../" value.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://www.securityfocus.com/bid/35418
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51206
• https://www.exploit-db.com/exploits/8978
• http://osvdb.org/55184
• http://secunia.com/advisories/35489

References

• http://www.securityfocus.com/bid/35418
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51206
• https://www.exploit-db.com/exploits/8978
• http://osvdb.org/55184
• http://secunia.com/advisories/35489

• ←Previous
• Next→