CVE-2009-4887 PHP remote file inclusion vulnerability in index.php in CMS S.Builder 3.7 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in a binn_inclu...
MediumCVSS 6.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in index.php in CMS S.Builder 3.7 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in a binn_include_path cookie. NOTE: this can also be leveraged to include and execute arbitrary local files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sbuilder cms s.builder | <= 3.7 | No fix listed |
References
- 8172 exploit
- 34037 exploit vdb-entry
- cmssbuilder-index-file-include(49139) vdb-entry