medium6.8Public exploit code
CVE-2009-3660
PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to exe…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- efront 3.5.4 - 'database.php?path' Remote File Inclusion2009-09-15 · webapps · php · Verified
Impact
PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Efrontlearning | Efront | through 3.5.4 Versions 3.1.0, 3.1.2, 3.1.3, 3.1.4, 3.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174
- http://www.exploit-db.com/exploits/9681
- http://www.securityfocus.com/bid/36411
- http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174
- http://www.exploit-db.com/exploits/9681
- http://www.securityfocus.com/bid/36411