CVE-2010-3206 Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang parameter to modules/guestbook/blocks/control.block.php...
HighCVSS 7.5
EPSS 2.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang parameter to modules/guestbook/blocks/control.block.php, (2) main_module parameter to index.php, and (3) getFile parameter to includes/general.functions.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| diy-cms | = 1.0 | No fix listed |
References
- packetstormsecurity.org exploit
- 14822 exploit
- diycms-multiple-file-include(61454) vdb-entry