CVE-2009-2024: Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the…

PriorityP333medium5CVSS 2.0

AVNACLAuNCPINAN

EXPLOIT

EPSS

2.29%

81.0th percentile

Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
vt.rovno	asp_vt_auth	—	—

CVSS provenance

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

vendor_redhat7.8HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_CLIENT Adobe Acrobat Reader FlateDecode Stream Predictor Exploit Attempt

suricata·2011-07-01

CVE-2009-3459 ET WEB_CLIENT Adobe Acrobat Reader FlateDecode Stream Predictor Exploit Attempt ET WEB_CLIENT Adobe Acrobat Reader FlateDecode Stream Predictor Exploit Attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Acrobat Reader FlateDecode Stream Predictor Exploit Attempt"; flow:established,to_client; file.data; content:"Colors 1073741838"; fast_pattern; pcre:"/]*\x2FPredictor[^>]*\x2FColors\x201073741838/smi"; reference:url,www.fortiguard.com/analysis/pdfanalysis.html; reference:bid,36600; reference:cve,2009-3459; classtype:attempted-user; sid:2013153; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_01, cve CVE_2009_3459, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09;)

Suricata

ET WEB_SERVER HP OpenView /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt

suricata·2010-07-30

CVE-2009-0921 ET WEB_SERVER HP OpenView /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt ET WEB_SERVER HP OpenView /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt Rule: alert http1 $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER HP OpenView /OvCgi/Toolbar.exe Accept Language Heap Buffer Overflow Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/OvCgi/Toolbar.exe"; nocase; fast_pattern; http.header; content:"Accept-Language|3a 20|"; nocase; isdataat:1350,relative; content:!"|0A|"; within:1350; content:"Content-Length|3a|"; distance:0; reference:cve,2009-0921; classtype:web-application-attack; sid:2010864; rev:11; metadata:created_at 2010_07_30, cve CVE_2009_0921, confidence High, signature_severity Major, updated_at 2024_04_10;)

Suricata

ET WEB_SPECIFIC_APPS TECHNOTE shop_this_skin_path Parameter Remote File Inclusion

suricata·2010-07-30·CVSS 6.8

CVE-2009-0441 [MEDIUM] ET WEB_SPECIFIC_APPS TECHNOTE shop_this_skin_path Parameter Remote File Inclusion ET WEB_SPECIFIC_APPS TECHNOTE shop_this_skin_path Parameter Remote File Inclusion Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS TECHNOTE shop_this_skin_path Parameter Remote File Inclusion"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/body_default.php?"; nocase; content:"GOODS[no]="; nocase; content:"GOODS[gs_input]="; nocase; content:"shop_this_skin_path="; nocase; pcre:"/shop_this_skin_path=\s*(https?|ftps?|php)\:\//i"; reference:url,secunia.com/advisories/33732/; reference:cve,CVE-2009-0441; reference:url,milw0rm.com/exploits/7965; classtype:web-application-attack; sid:2009229; rev:8; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Acce

Suricata

ET WEB_SPECIFIC_APPS PHP phpMyAgenda rootagenda Remote File Include Attempt

suricata·2010-07-30

CVE-2006-2009 ET WEB_SPECIFIC_APPS PHP phpMyAgenda rootagenda Remote File Include Attempt ET WEB_SPECIFIC_APPS PHP phpMyAgenda rootagenda Remote File Include Attempt Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS PHP phpMyAgenda rootagenda Remote File Include Attempt"; flow:established,to_server; http.uri; content:"rootagenda="; nocase; pcre:"/(agendaplace(2?)|infoevent|agenda(2?))\.php3\?/i"; pcre:"/rootagenda=(https?|ftps?|php)/i"; reference:cve,2006-2009; reference:bugtraq,17670; classtype:web-application-attack; sid:2002879; rev:10; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, cve CVE_2006_2009, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2024_03_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Publi

Suricata

ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt

suricata·2010-07-30

CVE-2009-2765 ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Possible DD-WRT Metacharacter Injection Command Execution Attempt"; flow:established,to_server; http.uri; content:"/cgi-bin/|3B|"; nocase; pcre:"/\x2Fcgi\x2Dbin\x2F\x3B.+[a-z]/i"; reference:url,isc.sans.org/diary.html?storyid=6853; reference:url,www.theregister.co.uk/2009/07/21/critical_ddwrt_router_vuln/; reference:url,www.dd-wrt.com/phpBB2/viewtopic.php?t=55173; reference:bid,35742; reference:cve,2009-2765; classtype:attempted-admin; sid:2009678; rev:10; metadata:created_at 2010_07_30, cve CVE_2009_2765, confidence Medium, signature_severity Major, updated_at 2024_03_06;)