CVE-2009-2109

FretsWeb 1.2 - Path Traversal via Language Parameter or Cookie

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-2109. PoCs published by YEnH4ckEr.

AI-analyzed exploit summary This is a writeup detailing multiple local file inclusion (LFI) vulnerabilities in FretsWeb 1.2. It describes how to exploit the 'language' GET parameter and the 'fretsweb_language' cookie to include local files using null byte injection.

Description

Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) language parameter to charts.php and the (2) fretsweb_language cookie parameter to unspecified vectors, possibly related to admin/common.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by YEnH4ckEr · textwebappsphp
https://www.exploit-db.com/exploits/8979

This is a writeup detailing multiple local file inclusion (LFI) vulnerabilities in FretsWeb 1.2. It describes how to exploit the 'language' GET parameter and the 'fretsweb_language' cookie to include local files using null byte injection.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: FretsWeb 1.2
No auth needed
Prerequisites: Access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/55166
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/35492
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/8979
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/55196

Scores

EPSS 0.0948
EPSS Percentile 94.8%

Details

CWE
CWE-22
Status published
Products (1)
fretsweb_project/fretsweb 1.2
Published Jun 18, 2009
Tracked Since Feb 18, 2026