CVE-2009-0886

Oneorzero Helpdesk < 1.6.5.7 - Path Traversal

Title source: rule

Description

Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by dun · textwebappsphp

https://www.exploit-db.com/exploits/8168

View Code ZIP pw:eip

References (4)

Core 4

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/8169

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/49114

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/34029

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/8168

Scores

EPSS 0.0382

EPSS Percentile 88.2%

Details

CWE

CWE-22

Status published

Products (10)

oneorzero/oneorzero_helpdesk 1.4_rc4

oneorzero/oneorzero_helpdesk 1.6

oneorzero/oneorzero_helpdesk 1.6.3

oneorzero/oneorzero_helpdesk 1.6.3.0

oneorzero/oneorzero_helpdesk 1.6.4

oneorzero/oneorzero_helpdesk 1.6.4.1

oneorzero/oneorzero_helpdesk 1.6.4.2

oneorzero/oneorzero_helpdesk 1.6.5.3

oneorzero/oneorzero_helpdesk 1.6.5.4

oneorzero/oneorzero_helpdesk < 1.6.5.7

Published Mar 12, 2009

Tracked Since Feb 18, 2026