Path Traversal in Basic-Cms Sweetrice

CVE-2009-4231

Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. (dot dot) in the plugin parameter.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.023 (81.7th percentile) — read the EPSS interpretation.

Affected products

Basic-cms Sweetrice — versions 0.2.0, 0.2.1, 0.3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (Exploit, x_refsource_MISC)