CVE

Id
38657  
CVE No.
CVE-2009-1222  
Status
Candidate  
Description
Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the WE_LANGUAGE parameter.  
Phase
Assigned (20090402)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
423327 38657 CVE-2009-1222 BUGTRAQ:20090331 webEdition 6.0.0.4 Local File Inclusion  View
423328 38657 CVE-2009-1222 URL:http://www.securityfocus.com/archive/1/archive/1/502315/100/0/threaded  View
423329 38657 CVE-2009-1222 MILW0RM:8328  View
423330 38657 CVE-2009-1222 URL:http://www.milw0rm.com/exploits/8328  View
423331 38657 CVE-2009-1222 BID:34323  View
423332 38657 CVE-2009-1222 URL:http://www.securityfocus.com/bid/34323  View
423333 38657 CVE-2009-1222 SECUNIA:34518  View
423334 38657 CVE-2009-1222 URL:http://secunia.com/advisories/34518  View
423335 38657 CVE-2009-1222 XF:webedition-index-file-include(49530)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
44925 JVNDB-2009-005932 Podcast Generator の core/admin/delete.php における任意のファイルを削除される脆弱性 Podcast Generator の core/admin/delete.php は、管理機能へのアクセス権を適切に制限しないため、任意のファイルを削除される脆弱性が存在します。 CVE-2009-1226 38657 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-005932.html  View