CVE-2009-1960
Last modified
CVE-2009-1960 is a vulnerability of currently unknown severity. inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.. EPSS estimates a 23.16% chance of exploitation in the next 30 days.
Description
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dokuwiki | Dokuwiki | 2009-02-14 |
| Dokuwiki | Dokuwiki | rc2009-01-30 |
| Dokuwiki | Dokuwiki | rc2009-02-06 |
References
- http://secunia.com/advisories/35218Vendor Advisory
- http://secunia.com/advisories/35218Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-1960?
How severe is CVE-2009-1960?
How do I fix CVE-2009-1960?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-1954Unspecified vulnerability in portmapper (aka portmap) in IBM…
- CVE-2009-1955The expat XML parser in the apr_xml_* interface in xml/apr_x…7.5
- CVE-2009-1956Off-by-one error in the apr_brigade_vprintf function in Apac…
- CVE-2009-1957charon/sa/ike_sa.c in the charon daemon in strongSWAN before…
- CVE-2009-1958charon/sa/tasks/child_create.c in the charon daemon in stron…
- CVE-2009-1959Off-by-one error in the event_wallops function in fe-common/…
- CVE-2009-1961The inode double locking code in fs/ocfs2/file.c in the Linu…4.7
- CVE-2009-1962Xfig, possibly 3.2.5, allows local users to read and write a…
- CVE-2009-1963Unspecified vulnerability in the Network Foundation componen…
- CVE-2009-1964Unspecified vulnerability in the Workspace Manager component…
- CVE-2009-1965Unspecified vulnerability in the Net Foundation Layer compon…
- CVE-2009-1966Unspecified vulnerability in the Config Management component…
Are you affected by CVE-2009-1960?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST