CVE-2009-3660

Published: Oct 11, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.

Affected (11)

Products: Efrontlearning: Efront

Efrontlearning

1 product

Efront

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Efrontlearning Efront	Up to 3.5.4
Efrontlearning Efront	Version 3.1.0
Efrontlearning Efront	Version 3.1.2
Efrontlearning Efront	Version 3.1.3
Efrontlearning Efront	Version 3.1.4
Efrontlearning Efront	Version 3.5.0
Efrontlearning Efront	Version 3.5.0 beta1
Efrontlearning Efront	Version 3.5.0 beta2
Efrontlearning Efront	Version 3.5.0 beta3
Efrontlearning Efront	Version 3.5.0 beta4
Efrontlearning Efront	Version 3.5.1