Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

CMSphp 0.21 lets attackers run local files via directory traversal

CVE-2009-3507 · published 17 years ago
Summary

The modules.php page in CMSphp 0.21 does not properly check the file name you ask it to load. By adding ".." (dot‑dot) in the mod_file input, an attacker can move up the folder structure and make the site load any file that exists on the server, which could let them run code or see private information. Update to a newer, patched version of CMSphp or apply a fix that validates and blocks such path tricks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
jean-michel_wyttenbach cmsphp 0.21
cpe:2.3:a:jean-michel_wyttenbach:cmsphp:0.21:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in modules.php in CMSphp 0.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod_file parameter.
Directory traversal vulnerability in modules.php in CMSphp 0.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod_file parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published1 Oct 2009
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-3507 · NVD
Track software like this
Free during beta