CVE-2009-2037 | BDVDB-2026-37018 Detail

Description#

Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) GLOBALS[SKIN] parameter to index.php and the (2) skin parameter to admin/admin.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://exchange.xforce.ibmcloud.com/vulnerabilities/50901
https://www.exploit-db.com/exploits/8853
https://exchange.xforce.ibmcloud.com/vulnerabilities/50902

Exploit#

https://www.exploit-db.com/exploits/8853

History#

Version 12009-06-12Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.