CVE

Id
39655  
CVE No.
CVE-2009-2220  
Status
Candidate  
Description
Multiple directory traversal vulnerabilities in Tribiq CMS 5.0.12c, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and possibly execute arbitrary files via directory traversal sequences in the template_path parameter to (1) masthead.inc.php, (2) toppanel.inc.php, and (3) contact.inc.php in templates/mytribiqsite/tribiq-CL-9000/includes; and the use_template_family parameter to (4) templates/mytribiqsite/tribiq-CL-9000/includes/nlarlist_content.inc.php. NOTE: the tribal-GPL-1066/includes/header.inc.php vector is already covered by CVE-2008-4894.  
Phase
Assigned (20090626)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
436110 39655 CVE-2009-2220 MILW0RM:9012  View
436111 39655 CVE-2009-2220 URL:http://www.milw0rm.com/exploits/9012  View
436112 39655 CVE-2009-2220 BID:35484  View
436113 39655 CVE-2009-2220 URL:http://www.securityfocus.com/bid/35484  View
436114 39655 CVE-2009-2220 SECUNIA:35535  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
42546 JVNDB-2009-003553 AN Guestbook の ang/shared/flags.php におけるディレクトリトラバーサルの脆弱性 AN Guestbook の ang/shared/flags.php には、register_globals が有効になった際、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2009-2224 39655 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003553.html  View