CVE-2009-3660 - PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter

Back Back to CVE browser

MEDIUM

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter

Published Oct 11, 2009

6.8

MEDIUM

CVSS 2.0

EPSS 1.86%

Description

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (4)

http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174
x_refsource_CONFIRM
http://www.exploit-db.com/exploits/9681
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/36411
vdb-entryx_refsource_BIDExploitPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3635
Advisory

Link	Providers	Tags
http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174		x_refsource_CONFIRM
http://www.exploit-db.com/exploits/9681		exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/36411		vdb-entryx_refsource_BIDExploitPatch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-3635		Advisory