CVE

Id
41750  
CVE No.
CVE-2009-4315  
Status
Candidate  
Description
Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a .. (dot dot) in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating and accessing a .php file to execute arbitrary PHP code.  
Phase
Assigned (20091214)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
458229 41750 CVE-2009-4315 MISC:http://packetstormsecurity.org/0912-exploits/nuggetz-exec.txt  View
458230 41750 CVE-2009-4315 CONFIRM:http://www.nuggetz.co.uk/versionhistory.htm  View
458231 41750 CVE-2009-4315 OSVDB:60902  View
458232 41750 CVE-2009-4315 URL:http://osvdb.org/60902  View
458233 41750 CVE-2009-4315 SECUNIA:37664  View
458234 41750 CVE-2009-4315 URL:http://secunia.com/advisories/37664  View
458235 41750 CVE-2009-4315 XF:nuggetz-ajaxsave-code-execution(54699)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
42960 JVNDB-2009-003967 eoCMS の js/bbcodepress/bbcode-form.php における PHP リモートファイルインクルージョンの脆弱性 eoCMS の js/bbcodepress/bbcode-form.php には、register_globals が有効な際、PHP リモートファイルインクルージョンの脆弱性が存在します。 CVE-2009-4319 41750 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003967.html  View