CVE-2009-2399: Code Injection

Published Jul 9, 2009

Updated

PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITYFILE parameter.

Affected Software

1 affected component

Dutchmonkey Dm Filemanager=3.9.4

Event History

Jul 9, 2009

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-2399?

CVE-2009-2399 is classified as a high-severity vulnerability due to its ability to allow remote code execution.

How do I fix CVE-2009-2399?

To fix CVE-2009-2399, disable register_globals in your PHP configuration and update to a patched version of DM FileManager.

What systems are affected by CVE-2009-2399?

CVE-2009-2399 specifically affects DM FileManager version 3.9.4 when register_globals is enabled.

Is CVE-2009-2399 exploitable remotely?

Yes, CVE-2009-2399 can be exploited remotely by sending a crafted URL to the vulnerable software.

What are the potential impacts of CVE-2009-2399?

The potential impacts of CVE-2009-2399 include arbitrary PHP code execution which can lead to server compromise.