PT-2010-5538 · Phpmyfaq · Phpmyfaq

Published 2010-12-17 · Updated 2010-12-20 · CVE-2010-4558

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 2.6.11 through 2.6.12

Description The issue allows remote attackers to execute arbitrary PHP code due to an externally introduced modification in the getTopTen method in inc/Faq.php.

Recommendations For versions 2.6.11 and 2.6.12, consider removing or replacing the modified getTopTen method in inc/Faq.php to prevent the execution of arbitrary PHP code.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-4558

Affected Products

Phpmyfaq

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-4558 · Security Note
• http://vupen.com/english/advisories/2010/3254 · Vendor Advisory
• http://phpmyfaq.de/advisory_2010-12-15.php · Vendor Advisory
• http://securityfocus.com/bid/45442 · Patch
• http://secunia.com/advisories/42622 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4558 · Note