CVE-2009-2399 - PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter

Back Back to CVE browser

MEDIUM

PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter

Published Jul 9, 2009

6.8

MEDIUM

CVSS 2.0

EPSS 1.69%

Description

PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

http://secunia.com/advisories/35622
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9044
exploitx_refsource_EXPLOIT-DB
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-2395
Advisory

Link	Providers	Tags
http://secunia.com/advisories/35622		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.exploit-db.com/exploits/9044		exploitx_refsource_EXPLOIT-DB
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-2395		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jul 9, 2009

Updated Aug 7, 2024

Reserved Jul 9, 2009

Link CVE-2009-2399

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-2399

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jul 9, 2009

Updated Aug 7, 2024

Link EUVD-2009-2395

GitHub

No data