CVE-2009-2159 backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and....
MediumCVSS 6.4
EPSS 2.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create and download a backup database by making a direct request and then retrieving a .gz file from backups/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| torrenttrader classic | = 1.09 | No fix listed |
References
- 35456 third-party-advisory vendor-advisory
- 20090615 [waraxe-2009-SA#074] - Multiple Vulnerabilities in TorrentTrader Classic 1.09 mailing-list
- 35369 exploit vdb-entry
- www.waraxe.us exploit
- torrenttrader-backupdatabase-info-disc(51147) vdb-entry
- 8958 exploit