CVE-2009-2787 - Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .

Back Back to CVE browser

MEDIUM

Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .

Published Aug 17, 2009

6.8

MEDIUM

CVSS 2.0

EPSS 4.17%

Description

Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pun_user[language] parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

http://osvdb.org/56613
vdb-entryx_refsource_OSVDB
http://packetstormsecurity.org/0907-exploits/punbbrep-lfi.txt
x_refsource_MISCExploit
http://secunia.com/advisories/36020
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9315
exploitx_refsource_EXPLOIT-DB
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-2777
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52138
vdb-entryx_refsource_XF

Link	Providers	Tags
http://osvdb.org/56613		vdb-entryx_refsource_OSVDB
http://packetstormsecurity.org/0907-exploits/punbbrep-lfi.txt		x_refsource_MISCExploit
http://secunia.com/advisories/36020		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9315		exploitx_refsource_EXPLOIT-DB
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-2777		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52138		vdb-entryx_refsource_XF