CVE-2006-5811 - PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with regist

CVE-2006-5811

Summary

PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[srcdir] parameter.

References

http://advisories.echo.or.id/adv/adv60-theday-2006.txt
http://secunia.com/advisories/22695
http://securityreason.com/securityalert/1844
http://www.securityfocus.com/archive/1/450698/100/0/threaded
http://www.vupen.com/english/advisories/2006/4382
https://exchange.xforce.ibmcloud.com/vulnerabilities/30036
https://www.exploit-db.com/exploits/2727

Vulnerable Configurations

cpe:2.3:a:openemr:openemr:2.8.1:*:*:*:*:*:*:*
cpe:2.3:a:openemr:openemr:2.8.1:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 17-10-2018 - 21:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bugtraq	20061106 [ECHO_ADV_60_2006] OpenEMR <=2.8.1 Multiple Remote File Inclusion Vulnerability
exploit-db	2727
misc	http://advisories.echo.or.id/adv/adv60-theday-2006.txt
secunia	22695
sreason	1844
vupen	ADV-2006-4382
xf	openemr-srcdir-file-include(30036)

Last major update

17-10-2018 - 21:45

Published

08-11-2006 - 23:07

Last modified

17-10-2018 - 21:45