Unscored severity · published Apr 17, 2009
CVE-2009-1318
Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows remote attackers to include arbitrary…
–
CVSS
2%
EPSS
No
On KEV
Description
Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows remote attackers to include arbitrary files via directory traversal sequences in the t parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jamroom · Jamroom
1.0; 1.0; 1.0; 1.0; 1.0; 1.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1318
Vendor Advisory
http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1470
Exploit
http://www.securityfocus.com/bid/34511
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/49869
www.exploit-db.com
https://www.exploit-db.com/exploits/8423
More from Jamroom
6.1
CVE-2012-6705
Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field
–
CVE-2010-2463
Cross-site scripting (XSS) vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter in a modify…
–
CVE-2008-3376
Multiple unspecified vulnerabilities in JamRoom before 3.4.0 have unknown impact and attack vectors
–
CVE-2008-3375
The jrCookie function in includes/jamroom-misc.inc.php in JamRoom before 3.4.0 allows remote attackers to bypass authentication and gain administrative access via a boolean value…
–
CVE-2008-2886
PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when register_globals is enabled, allows remote attackers to…