Vulnerability Description
Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) GLOBALS[SKIN] parameter to index.php and the (2) skin parameter to admin/admin.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Onlinegrades | Online Grades | <= 3.2.5 |
Related Weaknesses (CWE)
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50901
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50902
- https://www.exploit-db.com/exploits/8853
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50901
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50902
- https://www.exploit-db.com/exploits/8853
FAQ
What is CVE-2009-2037?
CVE-2009-2037 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is enabled, allow remote attackers to include and execute arbitr...
How severe is CVE-2009-2037?
CVE-2009-2037 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-2037?
Check the references section above for vendor advisories and patch information. Affected products include: Onlinegrades Online Grades.