CVE-2009-2784

Multiple directory traversal vulnerabilities in dit.cms 1.3, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path parameter to index.php in (1) install/, (2) menus/left_rightslideopen/, (3) menus/side_pullout/, (4) menus/side_slideopen/, (5) menus/simple/, (6) menus/top_dropdown/, and (7) menus/topside/; the sitemap parameter to index.php in (8) menus/left_rightslideopen/, (9) menus/side_pullout/, (10) menus/side_slideopen/, (11) menus/top_dropdown/, and (12) menus/topside/; and the (13) relPath parameter to index/index.php. NOTE: PHP remote file inclusion vulnerabilities reportedly also exist for some of these vectors.

• CWE-22

• http://secunia.com/advisories/36076Vendor Advisory
• http://www.exploit-db.com/exploits/9310
• http://secunia.com/advisories/36076Vendor Advisory
• http://www.exploit-db.com/exploits/9310

Published

Aug 17, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2778Cross-site scripting (XSS) vulnerability in visitor/view.php…
• CVE-2009-2779SQL injection vulnerability in index.php in AJ Matrix DNA al…
• CVE-2009-2780Multiple cross-site scripting (XSS) vulnerabilities in 68 Cl…
• CVE-2009-2781SQL injection vulnerability in forum.php in Arab Portal 2.x,…
• CVE-2009-2782SQL injection vulnerability in the JFusion (com_jfusion) com…
• CVE-2009-2783Multiple cross-site scripting (XSS) vulnerabilities in XOOPS…
• CVE-2009-2785Multiple cross-site scripting (XSS) vulnerabilities in PHP O…
• CVE-2009-2786SQL injection vulnerability in reputation.php in the Reputat…
• CVE-2009-2787Directory traversal vulnerability in include/reputation/rep_…
• CVE-2009-2788Multiple SQL injection vulnerabilities in Mobilelib GOLD 3 a…
• CVE-2009-2789SQL injection vulnerability in the Permis (com_groups) compo…
• CVE-2009-2790SQL injection vulnerability in cat_products.php in SoftBiz D…