CVE-2009-4465

DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in (1) templates/ including (2) templates/deluxe/admincp/, (3) templates/corporate/admincp/, and (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.37% chance of exploitation in the next 30 days, 83th percentile

Published

2009-12-30

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/10598

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/10598

References

• CVE Record
• NVD entry

Related

• CVE-2009-4464
• CVE-2009-4466
• CVE-2009-4462
• CVE-2009-4467
• CVE-2009-4461
• CVE-2009-4468