CVE-2009-3660

2009-10-1122:00:00

mitre

www.cve.org

AI Score

7.6

Confidence

Low

EPSS

0.023

Percentile

89.7%

JSON

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product’s security documentation.