CVE-2009-4315

Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a .. (dot dot) in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating and accessing a .php file to execute arbitrary PHP code.

• CWE-22

• http://osvdb.org/60902
• http://packetstormsecurity.org/0912-exploits/nuggetz-exec.txtExploit
• http://secunia.com/advisories/37664Vendor Advisory
• http://www.nuggetz.co.uk/versionhistory.htmVendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54699
• http://osvdb.org/60902
• http://packetstormsecurity.org/0912-exploits/nuggetz-exec.txtExploit
• http://secunia.com/advisories/37664Vendor Advisory
• http://www.nuggetz.co.uk/versionhistory.htmVendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54699

Published

Dec 14, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4309Heap-based buffer overflow in the Intel Indeo41 codec for Wi…
• CVE-2009-4310Stack-based buffer overflow in the Intel Indeo41 codec for W…
• CVE-2009-4311Unspecified vulnerability in the Indeo codec in Microsoft Wi…
• CVE-2009-4312Unspecified vulnerability in the Indeo codec in Microsoft Wi…
• CVE-2009-4313ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Wind…
• CVE-2009-4314Sun Ray Server Software 4.1 on Solaris 10, when Automatic Mu…
• CVE-2009-4316Cross-site scripting (XSS) vulnerability in searchresults_ma…
• CVE-2009-4317Cross-site scripting (XSS) vulnerability in index.php in Scr…
• CVE-2009-4318Cross-site scripting (XSS) vulnerability in index.php in Rea…
• CVE-2009-4319PHP remote file inclusion vulnerability in js/bbcodepress/bb…
• CVE-2009-4320Cross-site scripting (XSS) vulnerability in searchform.php i…
• CVE-2009-4321extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possib…