CVE-2009-3424

CVE-2009-3424 affects MaxCMS 3.11.20b: multiple remote file inclusion vulnerabilities when register_globals is enabled. An attacker can cause arbitrary PHP code execution by supplying URLs in a set of 34 parameters across various files (e.g., includes/InstantSite/inc.is_root.php; classes/...php; ...

CVE-2009-3425

CVE-2009-3425 affects MaxCMS 3.11.20b. A directory traversal flaw in the admin component, specifically includes/inc.thcms_admin_dirtree.php, allows remote attackers to read arbitrary files via traversal sequences in the thCMS_root parameter. Public references (NVD, CVE records) confirm the vulner...

CVE-2009-3426

CVE-2009-3426 concerns a PHP remote file inclusion in MaxCMS 3.11.20b. The flaw is in includes/file_manager/special.php, where the fm_includes_special parameter can be controlled to include a remote PHP file, enabling arbitrary code execution on the server. Documented affected component: MaxCMS 3...