CVE-2009-0592

high · 7.5

Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.

7.5

CVSS

28.8%

EPSS (exploit prob.)

98th

EPSS percentile

2009-02-16

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
pnphpbb	pnphpbb2	<= 1.2i
pnphpbb	pnphpbb2	1.0
pnphpbb	pnphpbb2	1.1
pnphpbb	pnphpbb2	1.1a
pnphpbb	pnphpbb2	1.2
pnphpbb	pnphpbb2	1.2a
pnphpbb	pnphpbb2	1.2d
pnphpbb	pnphpbb2	1.2e
pnphpbb	pnphpbb2	1.2f
pnphpbb	pnphpbb2	1.2g
pnphpbb	pnphpbb2	1.2h

Check a specific version with /api/v1/cve/match.

References

http://secunia.com/advisories/33365
http://www.securityfocus.com/bid/33103
https://www.exploit-db.com/exploits/7658
http://secunia.com/advisories/33365
http://www.securityfocus.com/bid/33103
https://www.exploit-db.com/exploits/7658

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-0592