CVE-2010-1946: Code Injection
Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when registerglobals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathom parameter to (1) autorisationnormale.class.php, (2) collectivite.class.php, (3) dossier.class.php, (4) normesimplifiee.class.php, (5) registre.class.php, (6) autorisationunique.class.php, (7) demandeavis.class.php, (8) droit.class.php, (9) organisme.class.php, (10) service.class.php, (11) categoriedonnee.class.php, (12) destinataire.class.php, (13) profil.class.php, (14) tabdynvisu.class.php, (15) categoriepersonne.class.php, (16) dispense.class.php, (17) modificatif.class.php, (18) reference.class.php, and (19) utilisateur.class.php in obj/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1946?
The severity of CVE-2010-1946 is medium with a CVSS score of 6.8.
How do I fix CVE-2010-1946?
To fix CVE-2010-1946, disable register_globals in your PHP configuration and update to a secure version of openMairie Openregistrecil.
What types of attacks are possible with CVE-2010-1946?
CVE-2010-1946 allows attackers to execute arbitrary PHP code through remote file inclusion due to improper handling of user input.
Which software is affected by CVE-2010-1946?
CVE-2010-1946 affects openMairie Openregistrecil version 1.02 when register_globals is enabled.
What is the impact of CVE-2010-1946 on affected systems?
The impact of CVE-2010-1946 on affected systems includes potential unauthorized code execution and possible complete system compromise.