LiveActive security incident?Get immediate response
CVE Record

CVE-2009-2037: Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly...

Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) GLOBALS[SKIN] parameter to index.php and the (2) skin parameter to admin/admin.php.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2009-2037 affects legacy Online Grades & Attendance installations. If PHP register_globals is enabled, a remote attacker may be able to make the application include and execute local files through skin-related input. This can become serious on an exposed school or administrative website, but the source bundle does not provide CVSS scoring or confirmed active exploitation.

Executive priority

Treat exposed legacy deployments as urgent to assess. Business urgency depends on whether this obsolete application is still reachable and misconfigured with register_globals enabled.

Technical view

The CVE describes multiple directory traversal local file inclusion flaws in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6. The affected paths are index.php using GLOBALS[SKIN] and admin/admin.php using skin, only when register_globals is enabled. Public exploit information is referenced, but KEV is false.

Likely exposure

Exposure is most likely in old PHP-hosted Online Grades & Attendance deployments that remain internet-facing and use register_globals. Modern systems are less likely exposed unless the legacy application or configuration persists.

Exploitation context

The source bundle cites an Exploit-DB entry, so public exploit information exists. It does not cite CISA KEV or any source confirming active exploitation in the wild.

Researcher notes

Evidence is sparse: no CVSS, no CWE mapping, and affected metadata is generic. The CVE description supplies the vulnerable parameters and version range, while references confirm vulnerability database and public exploit coverage.

Mitigation direction

  • Inventory for Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6.
  • Disable PHP register_globals wherever present.
  • Restrict public access to any remaining legacy deployment.
  • Check vendor or maintainer guidance before assuming a patch exists.
  • Retire or isolate unsupported installations if no maintained fix is available.

Validation and detection

  • Confirm whether Online Grades & Attendance is deployed.
  • Identify application version from deployment records or source files.
  • Check PHP configuration for register_globals.
  • Verify whether index.php and admin/admin.php are internet-accessible.
  • Review web logs for traversal or local file inclusion probes.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2009-2037 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.