CVE-2009-2132

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-06-19 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.

Affected products

4Homepages 4images: through 1.7.6; 1.0-rc-1, 1.0-rc-2, 1.5, 1.6, 1.6.1, 1.7 (+5)

References

http://bbs.wolvez.org/topic/56/
http://secunia.com/advisories/35427
http://www.4homepages.de/forum/index.php?topic=15186.0
http://bbs.wolvez.org/topic/56/
http://secunia.com/advisories/35427
http://www.4homepages.de/forum/index.php?topic=15186.0

Get alerted when CVE-2009-2132 or the next vulnerability affects your stack