CVE-2008-4529 Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the _ENV[asicms][path] parameter to (1) Association.php, (2)....
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the _ENV[asicms][path] parameter to (1) Association.php, (2) BigMath.php, (3) DiffieHellman.php, (4) DumbStore.php, (5) Extension.php, (6) FileStore.php, (7) HMAC.php, (8) MemcachedStore.php, (9) Message.php, (10) Nonce.php, (11) SQLStore.php, (12) SReg.php, (13) TrustRoot.php, and (14) URINorm.php in classes/Auth/OpenID/; and (15) XRDS.php, (16) XRI.php and (17) XRIRes.php in classes/Auth/Yadis/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asicms | = 0.208-alpha | No fix listed |
References
- 4391 third-party-advisory
- 31601 exploit vdb-entry
- ADV-2008-2755 vdb-entry
- asicms-envasicmspath-file-include(45684) vdb-entry
- 6685 exploit