CVE-2009-0966 - PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter

Back Back to CVE browser

HIGH

PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter

Published Mar 19, 2009

7.5

HIGH

CVSS 2.0

EPSS 2.54%

Description

PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (6)

http://osvdb.org/52789
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34325
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/34157
vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-0963
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49302
vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/8230
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://osvdb.org/52789		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/34325		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/bid/34157		vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-0963		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49302		vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/8230		exploitx_refsource_EXPLOIT-DB