CVE

Id
40977  
CVE No.
CVE-2009-3542  
Status
Candidate  
Description
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.  
Phase
Assigned (20091002)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
448585 40977 CVE-2009-3542 MISC:http://packetstormsecurity.org/0907-exploits/ls-lfi.txt  View
448586 40977 CVE-2009-3542 OSVDB:55969  View
448587 40977 CVE-2009-3542 URL:http://osvdb.org/55969  View
448588 40977 CVE-2009-3542 SECUNIA:35907  View
448589 40977 CVE-2009-3542 URL:http://secunia.com/advisories/35907  View
448590 40977 CVE-2009-3542 XF:littlesite-index-file-include(51819)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
41471 JVNDB-2009-002478 PHP および GD Graphics Library の _gdGetColors 関数におけるバッファオーバーフローの脆弱性 PHP および GD Graphics Library の _gdGetColors 関数には、colorsTotal の構成要素の検証に不備があるため、バッファオーバーフローの脆弱性が存在します。 CVE-2009-3546 40977 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002478.html  View