CVE-2010-1360

Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP code via a URL in the path_faqe parameter to (1) attachs.php, (2) backup.php, (3) badwords.php, (4) categories.php, (5) changepw.php, (6) colorchooser.php, (7) colorwheel.php, (8) dbfiles.php, (9) diraccess.php, (10) faq.php, (11) index.php, (12) kb.php, and (13) stats.php.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.29% chance of exploitation in the next 30 days, 83rd percentile

Published

2010-04-13

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/11111

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/11111

Security advisories

• http://www.securityfocus.com/bid/37719

References

• CVE Record
• NVD entry