CVE-2009-0610

Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/51816
http://secunia.com/advisories/33814	Vendor Advisory
http://osvdb.org/51816
http://secunia.com/advisories/33814	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dminnich:simple_php_news:1.0:*:*:*:*:*:*:*

History

21 Nov 2024, 01:00

Type	Values Removed	Values Added
References	~~() http://osvdb.org/51816 -~~	() http://osvdb.org/51816 -
References	~~() http://secunia.com/advisories/33814 - Vendor Advisory~~	() http://secunia.com/advisories/33814 - Vendor Advisory

Information

Published : 2009-02-17 17:30

Updated : 2024-11-21 01:00

NVD link : CVE-2009-0610

Mitre link : CVE-2009-0610

CVE.ORG link : CVE-2009-0610

JSON object : View

Products Affected

dminnich

simple_php_news

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2009-0610", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-02-17T17:30:06.030", "references": [{"url": "http://osvdb.org/51816", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/33814", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://osvdb.org/51816", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/33814", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."}, {"lang": "es", "value": "Multiples vulnerabilidades de inyecci\u00f3n de c\u00f3digo est\u00e1tico en post.php en Simple PHP News v1.0 final permite a atacantes remotos inyectar c\u00f3digo PHP de su elecci\u00f3n dentro de news.txt a trav\u00e9s de (1) title o (2) par\u00e1metro \"date\". y entonces ejecutar el c\u00f3digo a trav\u00e9s de una petici\u00f3n directa a display.php. NOTA: la procedencia de esta informaci\u00f3n es desconocida; los detalles han sido obtenidos exclusivamente a partir de informaci\u00f3n de terceros."}], "lastModified": "2024-11-21T01:00:30.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dminnich:simple_php_news:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43ECAF21-1F05-4D68-A261-12A1B578F51C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}