CVE-2010-1360

Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP code via a URL in the path_faqe parameter to (1) attachs.php, (2) backup.php, (3) badwords.php, (4) categories.php, (5) changepw.php, (6) colorchooser.php, (7) colorwheel.php, (8) dbfiles.php, (9) diraccess.php, (10) faq.php, (11) index.php, (12) kb.php, and (13) stats.php.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.29% chance of exploitation in the next 30 days, 82th percentile

Published

2010-04-13

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/11111

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/11111

References

• CVE Record
• NVD entry

Related

• CVE-2010-1357
• CVE-2010-1361
• CVE-2010-1354
• CVE-2010-1363
• CVE-2010-1353
• CVE-2010-1364