CVE-2009-3660

Published Oct 11, 2009

Last updated 7 years ago

Overview

Description: PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-94

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "136730A5-4699-4292-89DF-AB19E8081FA6",
            "versionEndIncluding": "3.5.4"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DC4945EB-C2DC-41FB-8B49-8F27D1EBF19E"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9648CD63-D34E-4298-8D54-2FF72C257477"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E993440A-7730-4540-B6BC-5CFC1636FE0C"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B9A7A13D-A022-49A0-BED7-701D333724B5"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8802C5D3-64CD-4199-ABBC-F5AEE5AFDE46"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BD62DC8C-619B-4B61-AFAC-B7F6AFCBEB79"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A230995D-9925-4774-9CFC-4329F756EE36"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "395AFAEC-9811-4CB8-A105-AB9B9C85DA68"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E7699ABE-E6AB-490F-9D1E-34F1EE2467B6"
          },
          {
            "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "964B61AA-BB5B-4B19-8077-0AD5415D4788"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References