Lucene search

MitreCVE-2009-4315

HistoryDec 14, 2009 - 9:17 p.m.

CVE-2009-4315

2009-12-1421:17:18

CWE-22

mitre

web.nvd.nist.gov

directory traversal

admin/ajaxsave.php

nuggetz cms 1.0

cve-2009-4315

magic_quotes_gpc disabled

remote code execution

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

High

EPSS

0.111

Percentile

95.2%

JSON

Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a … (dot dot) in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating and accessing a .php file to execute arbitrary PHP code.

Affected configurations

Nvd

Node

nuggetznuggetz_cmsMatch1.0

VendorProductVersionCPE
nuggetznuggetz_cms1.0cpe:2.3:a:nuggetz:nuggetz_cms:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nuggetz	nuggetz_cms	1.0	cpe:2.3:a:nuggetz:nuggetz_cms:1.0:::::::*

References

osvdb.org/60902

packetstormsecurity.org/0912-exploits/nuggetz-exec.txt

secunia.com/advisories/37664

www.nuggetz.co.uk/versionhistory.htm

exchange.xforce.ibmcloud.com/vulnerabilities/54699

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

High

EPSS

0.111

Percentile

95.2%

JSON

Related for CVE-2009-4315