PT-2009-5932 · Efront · Efront

Cr4Wl3R · Published 2009-10-11 · Updated 2017-09-19 · CVE-2009-3660

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Efront versions 3.5.4 and earlier

Description A remote file inclusion issue exists in the libraries/database.php file of Efront, allowing remote attackers to execute arbitrary PHP code via a URL in the path parameter when register globals is enabled. This issue is only present when the administrator does not follow the product's security documentation recommendations.

Recommendations For Efront versions 3.5.4 and earlier, ensure that register globals is disabled to prevent exploitation of this issue. As a temporary workaround, consider restricting access to the libraries/database.php file until a fix is available.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3660

Affected Products

Efront

References · 6

• 🔥 http://exploit-db.com/exploits/9681 · Exploit
• 🔥 http://securityfocus.com/bid/36411 · Exploit
• 🔥 https://exploit-db.com/exploits/9681 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3660 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3660 · Note
• http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174 · Note