CVE-2009-1948

CVE-2009-1948 describes multiple directory traversal vulnerabilities in Unclassified NewsBoard (UNB) 1.6.4. Specifically, when register_globals is enabled and magic_quotes_gpc is disabled, remote attackers can read arbitrary files or include and execute local files by manipulating specific GLOBALS parameters with directory traversal sequences. The vulnerability has a CVSS score of 5.1, indicating a medium severity. It can be exploited remotely with high attack complexity, potentially leading to partial compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation (not in KEV), exploit code is publicly available on ExploitDB (EDB-8841). However, there is no recorded community discussion or media coverage, suggesting low public attention.