CVE-2010-1944

Published: May 19, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple PHP remote file inclusion vulnerabilities in openMairie openCimetiere 2.01, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) autorisation.class.php, (2) courrierautorisation.class.php, (3) droit.class.php, (4) profil.class.php, (5) temp_defunt_sansemplacement.class.php, (6) utils.class.php, (7) cimetiere.class.php, (8) defunt.class.php, (9) emplacement.class.php, (10) tab_emplacement.class.php, (11) temp_emplacement.class.php, (12) voie.class.php, (13) collectivite.class.php, (14) defunttransfert.class.php, (15) entreprise.class.php, (16) temp_autorisation.class.php, (17) travaux.class.php, (18) zone.class.php, (19) courrier.class.php, (20) dossier.class.php, (21) plans.class.php, (22) temp_defunt.class.php, and (23) utilisateur.class.php in obj/.

Affected (1)

Products: Openmairie: Opencimetiere

Openmairie

1 product

Opencimetiere

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openmairie Opencimetiere	Version 2.01

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (58)

http://packetstormsecurity.org/1005-exploits/opencimetiere-rfi.txt

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/39687

Source: cve@mitre.org

Vendor Advisory

http://www.exploit-db.com/exploits/12476

Source: cve@mitre.org

Exploit

http://www.osvdb.org/64223

Source: cve@mitre.org

http://www.osvdb.org/64224

Source: cve@mitre.org

http://www.osvdb.org/64225

Source: cve@mitre.org

http://www.osvdb.org/64226

Source: cve@mitre.org

http://www.osvdb.org/64227

Source: cve@mitre.org

http://www.osvdb.org/64228

Source: cve@mitre.org

http://www.osvdb.org/64229

Source: cve@mitre.org

http://www.osvdb.org/64230

Source: cve@mitre.org

http://www.osvdb.org/64231

Source: cve@mitre.org

http://www.osvdb.org/64232

Source: cve@mitre.org

http://www.osvdb.org/64233

Source: cve@mitre.org

http://www.osvdb.org/64234

Source: cve@mitre.org

http://www.osvdb.org/64235

Source: cve@mitre.org

http://www.osvdb.org/64236

Source: cve@mitre.org

http://www.osvdb.org/64237

Source: cve@mitre.org

http://www.osvdb.org/64238

Source: cve@mitre.org

http://www.osvdb.org/64239

Source: cve@mitre.org

http://www.osvdb.org/64240

Source: cve@mitre.org

http://www.osvdb.org/64241

Source: cve@mitre.org

http://www.osvdb.org/64242

Source: cve@mitre.org

http://www.osvdb.org/64243

Source: cve@mitre.org

http://www.osvdb.org/64244

Source: cve@mitre.org

http://www.osvdb.org/64245

Source: cve@mitre.org

http://www.securityfocus.com/bid/39883

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2010/1050

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/58267

Source: cve@mitre.org

http://packetstormsecurity.org/1005-exploits/opencimetiere-rfi.txt