CVE-2009-4512

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the obj_id parameter.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.org/0910-exploits/oscailt33-lfi.txtExploit
http://secunia.com/advisories/37180Vendor Advisory
http://securityreason.com/exploitalert/7422Exploit
http://www.vupen.com/english/advisories/2009/3096Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54023
http://packetstormsecurity.org/0910-exploits/oscailt33-lfi.txtExploit
http://secunia.com/advisories/37180Vendor Advisory
http://securityreason.com/exploitalert/7422Exploit
http://www.vupen.com/english/advisories/2009/3096Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/54023

Timeline

Published: Dec 31, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-45133.5Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, a CVE-2009-45143.5Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows CVE-2009-45155.0The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote atta CVE-2009-45164.3Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to i CVE-2009-45176.8Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attacke CVE-2009-45184.3Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject arbitrary CVE-2009-451910.0Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors.CVE-2009-45205.0The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended CVE-2009-45214.3Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as use CVE-2009-45224.3Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML CVE-2009-45234.3Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web script or HTML via the se CVE-2009-45244.3Cross-site scripting (XSS) vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrar