[Forgot Password]
Login  Register Subscribe

23631

 
 

115084

 
 

97559

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2009-4116

Date: (C)2009-11-30   (M)2017-08-18
 
CVSS Score: 3.5Access Vector: NETWORK
Exploitability Subscore: 6.8Access Complexity: MEDIUM
Impact Subscore: 2.9Authentication: SINGLE_INSTANCE
 Confidentiality: PARTIAL
 Integrity: NONE
 Availability: NONE











Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magic_quotes_gpc is disabled, allow remote authenticated users with editor or administrative application access to read arbitrary files via a .. (dot dot) in the source parameter in a (1) list or (2) editnews action to the Editnews module, and (3) the save_con[skin] parameter in the Options module. NOTE: vector 3 can be leveraged for code execution by using a .. to include and execute arbitrary local files.

Reference:
http://www.securityfocus.com/archive/1/archive/1/507782/100/0/threaded
cutenews-editnews-dir-traversal(54246)
cutenews-options-file-include(54244)
http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt

CWE    1
CWE-22

© 2013 SecPod Technologies