Lucene search

MitreCVE-2009-2218

HistoryJun 25, 2009 - 11:14 p.m.

CVE-2009-2218

2009-06-2523:14:15

CWE-94

mitre

web.nvd.nist.gov

cve-2009-2218

php

remote file inclusion

phpcollegeexchange

vulnerability

nvd

security

php code execution

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

Low

EPSS

0.002

Percentile

57.5%

JSON

Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the home parameter to (1) i_head.php, (2) i_nav.php, (3) user_new_2.php, or (4) house/myrents.php; or (5) allbooks.php, (6) home.php, or (7) mybooks.php in books/. NOTE: house/myrents.php was also separately reported as a local file inclusion issue.

Affected configurations

Nvd

Node

david_degnerphpcollegeexchangeMatch0.1.5c

VendorProductVersionCPE
david_degnerphpcollegeexchange0.1.5ccpe:2.3:a:david_degner:phpcollegeexchange:0.1.5c:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
david_degner	phpcollegeexchange	0.1.5c	cpe:2.3:a:david_degner:phpcollegeexchange:0.1.5c:::::::*

References

secunia.com/advisories/35452

www.exploit-db.com/exploits/9008

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

Low

EPSS

0.002

Percentile

57.5%

JSON

Related for CVE-2009-2218