Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Flashlight Free Edition admin.php allows file inclusion

CVE-2009-4205 · published 16 years ago
Summary

The admin.php page in Flashlight Free Edition can be tricked into loading any file on the server by using ".." in the action field. An attacker could then run unwanted code or view private information. Apply the vendor's update or limit access to the admin page to stop this.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ringsworld flashlight_free_edition All versions
cpe:2.3:a:ringsworld:flashlight_free_edition:*:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter.
Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published4 Dec 2009
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-4205 · NVD
Track software like this
Free during beta