CVE-2009-4315
published 2009-12-14CVE-2009-4315: Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify…
PriorityP339medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
2.02%
78.5th percentile
Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a .. (dot dot) in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating and accessing a .php file to execute arbitrary PHP code.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nuggetz | nuggetz_cms | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://osvdb.org/60902http://packetstormsecurity.org/0912-exploits/nuggetz-exec.txthttp://secunia.com/advisories/37664http://www.nuggetz.co.uk/versionhistory.htmhttps://exchange.xforce.ibmcloud.com/vulnerabilities/54699http://osvdb.org/60902http://packetstormsecurity.org/0912-exploits/nuggetz-exec.txthttp://secunia.com/advisories/37664http://www.nuggetz.co.uk/versionhistory.htmhttps://exchange.xforce.ibmcloud.com/vulnerabilities/54699
2009-12-14
Published