CVE-2009-3211
VivaPrograms Infinity Script 2.x.x - Path Traversal via options[style_dir] Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-3211. PoCs published by SwEET-DeViL.
AI-analyzed exploit summary This exploit demonstrates a local file disclosure vulnerability and an authentication bypass in Infinity CMS v2.X.X. The LFD is achieved via path traversal in the 'style_dir' parameter, while the auth bypass uses SQL injection in the login form.
Description
Directory traversal vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the options[style_dir] parameter to the default URI.
Exploits (1)
This exploit demonstrates a local file disclosure vulnerability and an authentication bypass in Infinity CMS v2.X.X. The LFD is achieved via path traversal in the 'style_dir' parameter, while the auth bypass uses SQL injection in the login form.