CVE-2009-0592

Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.

Affected products

Pnphpbb2

Pnphpbb pnphpbb2

≤ 1.2i, 1.0, 1.1, 1.1a, 1.2, 1.2a, 1.2d, 1.2e, 1.2f, 1.2g, 1.2h

Fix

Available

CVSS 2.0

7.5 HIGH

EPSS

28.8% (98th percentile)

Weakness

CWE-22

NVD status

Modified

Published

2009-02-16