PT-2010-3544 · Openmairie · Openmairie Openannuaire

Cr4Wl3R · Publicado 2010-05-12 · Atualizado 2010-05-13 · CVE-2010-1921

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenMairie openAnnuaire version 2.00

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved by providing a URL in the path om parameter to various PHP files, including annuaire.class.php, droit.class.php, collectivite.class.php, profil.class.php, direction.class.php, service.class.php, directiongenerale.class.php, and utilisateur.class.php in the obj/ directory.

Recommendations For OpenMairie openAnnuaire version 2.00, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the affected PHP files in the obj/ directory until a patch is available. Avoid using the path om parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-1921

Produtos afetados

Openmairie Openannuaire

Referências · 15

• 🔥 https://exploit-db.com/exploits/12486 · Exploit
• 🔥 http://exploit-db.com/exploits/12486 · Exploit
• 🔥 http://packetstormsecurity.org/1005-exploits/openmairie-rfilfi.txt · Exploit
• 🔥 http://securityfocus.com/bid/39887 · Exploit
• http://osvdb.org/64178 · Nota
• http://osvdb.org/64180 · Nota
• http://osvdb.org/64184 · Nota
• http://vupen.com/english/advisories/2010/1059 · Aviso do Fabricante
• http://osvdb.org/64179 · Nota
• http://secunia.com/advisories/39673 · Aviso do Fabricante
• http://osvdb.org/64182 · Nota
• http://osvdb.org/64181 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1921 · Nota de Segurança
• http://osvdb.org/64176 · Nota
• http://osvdb.org/64177 · Nota