CVE-2009-4415

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

3.35%

Published

Dec 24, 2009

Modified

Apr 22, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php.

Weaknesses (CWE)

CWE-22

Affected Products (1)

phpgroupware · phpgroupwarevulnerable

References (20)

http://secunia.com/advisories/35519

Vendor Advisory

http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/csv_import.php?r1=15464&r2=19117&pathrev=19117&sortby=date&root=phpgroupware

http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/addressbook/inc/class.uiXport.inc.php?r1=14819&r2=19117&pathrev=19117&sortby=date&root=phpgroupware

http://svn.savannah.gnu.org/viewvc/branches/Version-0_9_16-branch/phpgwapi/doc/CHANGELOG?r1=17045&r2=19117&pathrev=19117&sortby=date&root=phpgroupware

http://svn.savannah.gnu.org/viewvc?view=rev&root=phpgroupware&sortby=date&revision=19117

http://www.openwall.com/lists/oss-security/2009/12/20/1

KEV Catalog EPSS Scores Vendors All CVEs