CVE-2009-2177

EPSS 4.2%

code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to conduct directory traversal attacks and overwrite arbitrary files via a "....//" (dot dot) in the s parameter, which is collapsed into a "../" value.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/8978unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/55184 http://secunia.com/advisories/35489 https://exchange.xforce.ibmcloud.com/vulnerabilities/51206 https://www.exploit-db.com/exploits/8978 http://www.securityfocus.com/bid/35418