Directory Traversal Vulnerabilities in Page Engine CMS by Unknown Vendor

CVE-2009-0729

Summary

Multiple directory traversal vulnerabilities in Page Engine CMS versions 2.0 Basic and Pro allow remote attackers to manipulate file inclusion mechanisms. By exploiting the fPrefix parameter, attackers can craft inputs that enable them to include and execute arbitrary local files within the CMS. This includes critical modules such as recent_poll_include.php, login_include.php, and statistics_include.php, as well as configuration files located in the includes directory. These vulnerabilities pose significant risks if left unaddressed, potentially allowing unauthorized access to sensitive server files.

References