CVE-2005-3519 Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the (1) INCLUDE_PATH and (2) SQUIZLIB_PATH par...
HighCVSS 7.5
EPSS 8.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the (1) INCLUDE_PATH and (2) SQUIZLIB_PATH parameters in new_upgrade_functions.php, (3) the INCLUDE_PATH parameter in init_mysource.php, and the PEAR_PATH parameter in (4) Socket.php, (5) Request.php, (6) Mail.php, (7) Date.php, (8) Span.php, (9) mimeDecode.php, and (10) mime.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mysource | = 2.14.0 | No fix listed |
| mysource | = 2.14.0rc2 | No fix listed |
References
- 20051018 Secunia Research: MySource Cross-Site Scripting and File Inclusion mailing-list
- 16946 exploit patch third-party-advisory vendor-advisory
- 92 third-party-advisory
- 1015075 exploit patch vdb-entry vendor-advisory
- 20035 vdb-entry
- 20036 vdb-entry
- 20037 vdb-entry
- 20038 vdb-entry
- 20039 vdb-entry
- 20040 vdb-entry
- 20041 vdb-entry
- 20042 vdb-entry
- 20043 vdb-entry
- 15133 exploit patch vdb-entry
- ADV-2005-2132 vdb-entry
- mysource-multiple-file-include(22772) vdb-entry