CVE-2009-2161

Name of the Vulnerable Software and Affected Versions TorrentTrader Classic version 1.09

Description A directory traversal issue exists in the backend/admin-functions.php file, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the ss uri parameter, in conjunction with a modified component name, on case-insensitive web sites.

Recommendations For TorrentTrader Classic version 1.09, consider restricting access to the ss uri parameter in the backend/admin-functions.php file to prevent directory traversal attacks. As a temporary workaround, avoid using the ss uri parameter with modified component names until a patch is available.