CVE-2009-4465
DeluxeBB 1.3 - Unauthenticated Sensitive Information Exposure via Direct Request
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-4465. PoCs published by cp77fk4r.
AI-analyzed exploit summary This is a technical writeup detailing multiple vulnerabilities in DeluxeBB, including XSS, full path disclosure, and authentication bypass. It provides specific URLs and parameters to exploit these issues but does not include functional exploit code.
Description
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in (1) templates/ including (2) templates/deluxe/admincp/, (3) templates/corporate/admincp/, and (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/.
Exploits (1)
This is a technical writeup detailing multiple vulnerabilities in DeluxeBB, including XSS, full path disclosure, and authentication bypass. It provides specific URLs and parameters to exploit these issues but does not include functional exploit code.