4homepages 4images up to 1.7.6 global.php path traversal

Summaryinfo

A vulnerability has been found in 4homepages 4images up to 1.7.6 and classified as problematic. The affected element is an unknown function of the file global.php. Performing a manipulation results in path traversal. This vulnerability is identified as CVE-2009-2132. Additionally, an exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in 4homepages 4images up to 1.7.6. This affects an unknown part of the file global.php. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.

The weakness was released 06/19/2009 (Website). The advisory is shared at 4homepages.de. This vulnerability is uniquely identified as CVE-2009-2132 since 06/19/2009. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:global.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.7.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (8936) and Secunia (SA35427†). Entry connected to this vulnerability is available at VDB-48680. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• 4homepages

Name

• 4images

Version

• 1.0
• 1.5
• 1.6
• 1.6.1
• 1.7
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5
• 1.7.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion