Secunia
Login
|
|
CVE Reference: CVE-2009-1912 |
|
| NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE. | |
|
Original Page at CVE MITRE: CVE-2009-1912 |
|
|
Description: Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to include and execute arbitrary local .php files via a .. (dot dot) in a language cookie. NOTE: this can be leveraged for SQL injection by including awards.php. |
|
|
CVE Status: Candidate |
|
|
References: XF http://xforce.iss.net/xforce/xfdb/50395 SAID Secunia Advisory: SA35016 OSVDB 54295 54296 MILW0RM http://www.milw0rm.com/exploits/8622 CONFIRM http://www.webspell.org/ http://www.webspell.org/index.php?site=files&file=30 http://www.webspell.org/index.php?site=news_comments&newsID=130 BID 34862 |
|
| Return to the previous page. |
