CVE-2010-1944: Code Injection
Multiple PHP remote file inclusion vulnerabilities in openMairie openCimetiere 2.01, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to (1) autorisation.class.php, (2) courrierautorisation.class.php, (3) droit.class.php, (4) profil.class.php, (5) tempdefuntsansemplacement.class.php, (6) utils.class.php, (7) cimetiere.class.php, (8) defunt.class.php, (9) emplacement.class.php, (10) tabemplacement.class.php, (11) tempemplacement.class.php, (12) voie.class.php, (13) collectivite.class.php, (14) defunttransfert.class.php, (15) entreprise.class.php, (16) tempautorisation.class.php, (17) travaux.class.php, (18) zone.class.php, (19) courrier.class.php, (20) dossier.class.php, (21) plans.class.php, (22) tempdefunt.class.php, and (23) utilisateur.class.php in obj/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1944?
The severity of CVE-2010-1944 is medium with a score of 6.8.
How do I fix CVE-2010-1944?
To fix CVE-2010-1944, disable register_globals in the PHP configuration and ensure that user inputs are properly sanitized.
What software is affected by CVE-2010-1944?
CVE-2010-1944 affects openMairie openCimetiere version 2.01.
What type of vulnerability is CVE-2010-1944?
CVE-2010-1944 is classified as a Code Injection vulnerability.
Can CVE-2010-1944 lead to remote code execution?
Yes, CVE-2010-1944 allows remote attackers to execute arbitrary PHP code through file inclusion.