CVE-2009-4088

telepark.wiki <2.4.23 - Path Traversal

Title source: llm

Description

Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via directory traversal sequences in the css parameter to (1) getjs.php and (2) getcsslocal.php; and include and execute arbitrary local files via the (3) group parameter to upload.php.

Exploits (2)

exploitdb WORKING POC VERIFIED

by corelanc0d3r · perllocalwindows

https://www.exploit-db.com/exploits/9483

View Code ZIP pw:eip

exploitdb WRITEUP

webappsphp

https://www.exploit-db.com/exploits/10101

View Code ZIP pw:eip

References (8)

[Patch] http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/

[Exploit] http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt

[Vendor Advisory] http://secunia.com/advisories/37391

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/54327

[Exploit, Third Party Advisory] http://www.exploit-db.com/exploits/9483

[Third Party Advisory, VDB Entry] http://www.osvdb.org/60216

[Third Party Advisory, VDB Entry] http://www.osvdb.org/60217

[Third Party Advisory, VDB Entry] http://www.osvdb.org/60218

Scores

EPSS 0.1523

EPSS Percentile 94.6%

Details

CWE

CWE-22

Status published

Products (1)

telepark/telepark.wiki < 2.4.23

Published Nov 29, 2009

Tracked Since Feb 18, 2026