CVE-2010-1946 Information

Description

Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02 when register_globals is enabled allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) autorisation_normale.class.php (2) collectivite.class.php (3) dossier.class.php (4) norme_simplifiee.class.php (5) registre.class.php (6) autorisation_unique.class.php (7) demande_avis.class.php (8) droit.class.php (9) organisme.class.php (10) service.class.php (11) categorie_donnee.class.php (12) destinataire.class.php (13) profil.class.php (14) tabdyn_visu.class.php (15) categorie_personne.class.php (16) dispense.class.php (17) modificatif.class.php (18) reference.class.php and (19) utilisateur.class.php in obj/.

Reference

http://packetstormsecurity.org/1004-exploits/openregistrecil-rfilfi.txt http://secunia.com/advisories/39534 http://www.exploit-db.com/exploits/12313 http://www.osvdb.org/63945 http://www.osvdb.org/63946 http://www.osvdb.org/63947 http://www.osvdb.org/63948 http://www.osvdb.org/63949 http://www.osvdb.org/63950 http://www.osvdb.org/63951 http://www.osvdb.org/63952 http://www.osvdb.org/63953 http://www.osvdb.org/63954 http://www.osvdb.org/63955 http://www.osvdb.org/63956 http://www.osvdb.org/63957 http://www.osvdb.org/63958 http://www.osvdb.org/63959 http://www.osvdb.org/63960 http://www.osvdb.org/63961 http://www.osvdb.org/63962 http://www.osvdb.org/63963 http://www.securityfocus.com/bid/39611