CVE-2009-4928 - PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055

Back Back to CVE browser

HIGH

PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055

Published Jul 9, 2010

7.5

HIGH

CVSS 2.0

EPSS 1.32%

Description

PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (3)

http://www.exploit-db.com/exploits/8494
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/34617
vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-4890
Advisory

Link	Providers	Tags
http://www.exploit-db.com/exploits/8494		exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/34617		vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-4890		Advisory