Lucene search

MitreCVE-2010-1335

HistoryApr 09, 2010 - 6:30 p.m.

CVE-2010-1335

2010-04-0918:30:00

CWE-94

mitre

web.nvd.nist.gov

cve-2010-1335

php

remote file inclusion

vulnerability

insky cms

security

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.095

Percentile

94.8%

JSON

Multiple PHP remote file inclusion vulnerabilities in Insky CMS 006-0111, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter to (1) city.get/city.get.php, (2) city.get/index.php, (3) message2.send/message.send.php, (4) message.send/message.send.php, and (5) pages.add/pages.add.php in insky/modules/. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

miftahovninsky_cmsMatch006-0111

VendorProductVersionCPE
miftahovninsky_cms006-0111cpe:2.3:a:miftahovn:insky_cms:006-0111:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
miftahovn	insky_cms	006-0111	cpe:2.3:a:miftahovn:insky_cms:006-0111:::::::*

References

osvdb.org/63149

osvdb.org/63150

osvdb.org/63151

osvdb.org/63152

osvdb.org/63153

packetstormsecurity.org/1003-exploits/inskycms-rfi.txt

secunia.com/advisories/39112

www.exploit-db.com/exploits/11848

exchange.xforce.ibmcloud.com/vulnerabilities/57112

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.095

Percentile

94.8%

JSON

Related for CVE-2010-1335