Back to Database
Status published
Medium
CVE-2009-1911
Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2...
Vulnerability Description
Directory traversal vulnerability in .include/init.php (aka admin/_include/init.php) in QuiXplorer 2.3.2 and earlier, as used in TinyWebGallery (TWG) 1.7.6 and earlier, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter to admin/index.php.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-1911
Credits & Attribution
No credits recorded in the NVD database.
References
- http://secunia.com/advisories/35060
- http://www.securityfocus.com/archive/1/503396/100/0/threaded
- http://secunia.com/advisories/35020
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50408
- http://www.tinywebgallery.com/forum/viewtopic.php?t=1653
- http://www.securityfocus.com/bid/34892
- https://www.exploit-db.com/exploits/8649
More from tinywebgallery
View All →CVE-2017-16635
In TinyWebGallery v2.4, an XSS vulnerability is located in the...
Medium
5.4
CVE-2014-5014
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows...
Critical
9.8
CVE-2013-2631
TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure...
Medium
5.3
CVE-2012-5347
TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via...
High
7.5
CVE-2012-2932
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8...
Medium
4.3
Affected Vendor
tinywebgallery
View all reports →Affected Software
tinywebgallery, quixplorer
Vulnerable Versions:
0, 1.0, 1.1, 1.01, 1.1.1, 1.1.2, 1.02, 1.2, 1.3, 1.03, 1.3a, 1.3b, 1.3c, 1.04, 1.4, 1.4.0.1, 1.4.0.2, 1.4.0.3, 1.4.0.4, 1.4.1, 1.4.1.1, 1.4.1.2, 1.4.1.3, 1.4.2, 1.05, 1.5, 1.5.0.1_15.08.2006, 1.5.0.2_17.08.2006, 1.5.1_03.09.2006, 1.5.2.1_20.09.2006_1000, 1.5.2.2_21.09.2006_1000, 1.5.2_17.09.2006_1000, 1.5.3.1_11.10.2006_1000, 1.5.3.2_12.10.2006_1000, 1.5.3_08.10.2006_1000, 1.5.4_13.10.2006, 1.5.5_30.10.2006_2200, 1.6, 1.6.1, 1.6.2, 1.6.3, 1.6.3.4, 1.7, 1.7.1, 1.7.2-18.04.2008, 1.7.3-12.05.2008, 1.7.3.1, 1.7.3.2, 1.7.3.3, 1.7.4, 1.7.4.1, 1.7.4.2, 1.7.4.3, 1.7.4.4, 1.7.4.5, 1.7.5, 1.7.5.1, 2.0, 2.1.1, 2.2, 2.3, 2.3.1
Timeline
Official Publish:
June 4th, 2009
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.