PT-2009-5932 · Efront · Efront

Cr4Wl3R · Publicado 2009-10-11 · Atualizado 2017-09-19 · CVE-2009-3660

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Efront versions 3.5.4 and earlier

Description A remote file inclusion issue exists in the libraries/database.php file of Efront, allowing remote attackers to execute arbitrary PHP code via a URL in the path parameter when register globals is enabled. This issue is only present when the administrator does not follow the product's security documentation recommendations.

Recommendations For Efront versions 3.5.4 and earlier, ensure that register globals is disabled to prevent exploitation of this issue. As a temporary workaround, consider restricting access to the libraries/database.php file until a fix is available.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-3660

Produtos afetados

Efront

Referências · 6

• 🔥 http://exploit-db.com/exploits/9681 · Exploit
• 🔥 http://securityfocus.com/bid/36411 · Exploit
• 🔥 https://exploit-db.com/exploits/9681 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3660 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3660 · Nota
• http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174 · Nota