CVE-2009-2177 describes a directory traversal vulnerability in fuzzylime CMS versions 3.03a and earlier, specifically in the code/display.php component. When magic_quotes_gpc is disabled, remote attackers can exploit this flaw by manipulating the 's' parameter with a "....//" sequence, which collapses to "../", allowing them to overwrite arbitrary files on the server. This vulnerability has a CVSS score of 6.8, indicating a medium severity with potential for partial confidentiality, integrity, and availability impact, and it can be exploited remotely with medium attack complexity. While not listed on the CISA KEV catalog, exploit code is publicly available on ExploitDB, and there is some community discussion, though no widespread active exploitation is indicated.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.03aCPE matchmatch criteria | cpe:2.3:a:fuzzylime:fuzzylime_cms:3.03a:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.