Path Traversal in Phpwebthings

CVE-2009-2081

Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.025 (83.2th percentile) — read the EPSS interpretation.

Affected products

  • Phpwebthings — versions 0.1, 0.2, 0.2b
  • N/a — versions n/a

Weakness classification (CWE)

References