CVE-2009-3542
LittleSite 0.1 - Path Traversal and Arbitrary File Execution via File Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-3542. PoCs published by Eolas_Gadai.
AI-analyzed exploit summary This is a vulnerability writeup describing a local file inclusion (LFI) vulnerability in LittleSite 0.1. The exploit demonstrates how an attacker can read arbitrary files by manipulating the 'file' parameter in the URL.
Description
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
Exploits (1)
This is a vulnerability writeup describing a local file inclusion (LFI) vulnerability in LittleSite 0.1. The exploit demonstrates how an attacker can read arbitrary files by manipulating the 'file' parameter in the URL.