CVE-2009-4088

Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via directory traversal sequences in the css parameter to (1) getjs.php and (2) getcsslocal.php; and include and execute arbitrary local files via the (3) group parameter to upload.php.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

2.80% chance of exploitation in the next 30 days, 85th percentile

Published

2009-11-27

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/9483

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/10101
• https://www.exploit-db.com/exploits/9483

References

• CVE Record
• NVD entry

Related

• CVE-2009-4086
• CVE-2009-4089
• CVE-2009-4085
• CVE-2009-4091
• CVE-2009-4082
• CVE-2009-4092