CVE

Id
38401  
CVE No.
CVE-2009-0966  
Status
Candidate  
Description
PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.  
Phase
Assigned (20090318)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
419140 38401 CVE-2009-0966 MILW0RM:8230  View
419141 38401 CVE-2009-0966 URL:http://www.milw0rm.com/exploits/8230  View
419142 38401 CVE-2009-0966 BID:34157  View
419143 38401 CVE-2009-0966 URL:http://www.securityfocus.com/bid/34157  View
419144 38401 CVE-2009-0966 OSVDB:52789  View
419145 38401 CVE-2009-0966 URL:http://osvdb.org/52789  View
419146 38401 CVE-2009-0966 SECUNIA:34325  View
419147 38401 CVE-2009-0966 URL:http://secunia.com/advisories/34325  View
419148 38401 CVE-2009-0966 XF:megafile-cross-file-include(49302)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
44887 JVNDB-2009-005894 PHP Pro Bid の includes/class_image.php における PHP リモートファイルインクルージョンの脆弱性 PHP Pro Bid の includes/class_image.php には、register_globals が有効になっている際、PHP リモートファイルインクルージョンの脆弱性が存在します。 CVE-2009-0970 38401 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-005894.html  View