« Volver al listado

CVE-2009-3660

Estado: ModificadaMedia (6.8)—

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Efrontlearning — Efront

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3660",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-10-11T22:30:00.467",
  "references": [
    {
      "url": "http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9681",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/36411",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9681",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36411",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.  NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inclusión remota de archivos PHP en libraries/database.php en Efront v3.5.4 y anteriores, cuando register_globals está activado, permite a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro \"path\". NOTA: esto es sólo una vulnerabilidad cuando el administrador no sigue las recomendaciones de seguridad en la documentación del producto."
    }
  ],
  "lastModified": "2026-06-16T23:12:06.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "136730A5-4699-4292-89DF-AB19E8081FA6",
              "versionEndIncluding": "3.5.4"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC4945EB-C2DC-41FB-8B49-8F27D1EBF19E"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9648CD63-D34E-4298-8D54-2FF72C257477"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E993440A-7730-4540-B6BC-5CFC1636FE0C"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9A7A13D-A022-49A0-BED7-701D333724B5"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8802C5D3-64CD-4199-ABBC-F5AEE5AFDE46"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD62DC8C-619B-4B61-AFAC-B7F6AFCBEB79"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A230995D-9925-4774-9CFC-4329F756EE36"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "395AFAEC-9811-4CB8-A105-AB9B9C85DA68"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7699ABE-E6AB-490F-9D1E-34F1EE2467B6"
            },
            {
              "criteria": "cpe:2.3:a:efrontlearning:efront:3.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "964B61AA-BB5B-4B19-8077-0AD5415D4788"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}