CVE-2009-1774: Path Traversal

Published May 22, 2009

Updated

Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to example/index.php. NOTE: this was originally reported as an issue affecting the do parameter, but traversal with that parameter might depend on a modified example/index.php. NOTE: some of these details are obtained from third party information.

Affected Software

1 affected component

Strawberry Strawberry=1.1.1

Event History

May 22, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1774?

CVE-2009-1774 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2009-1774?

To fix CVE-2009-1774, upgrade to a version of Strawberry that is not vulnerable to directory traversal.

What kind of attacks are possible with CVE-2009-1774?

CVE-2009-1774 allows remote attackers to include and execute arbitrary local files, leading to potential full system compromise.

Which software versions are affected by CVE-2009-1774?

CVE-2009-1774 specifically affects Strawberry version 1.1.1.

Can CVE-2009-1774 be exploited remotely?

Yes, CVE-2009-1774 can be exploited remotely by manipulating the file parameter to access local files.