ID de Prueba:	1.3.6.1.4.1.25623.1.0.80085
Categoría:	Web application abuses
Título:	Segue CMS themesdir Parameter Remote File Include Vulnerability
Resumen:	The remote web server contains a PHP script that is affected by a;remote file include issue.;;Description:;;The remote web server is running Segue CMS, an open source content;management system tailored for educational institutions.;;The version of Segue CMS installed on the remote host fails to;sanitize input to the 'themesdir' parameter before using it in the;'themes/program/themesettings.inc.php' script to include PHP code.;Provided PHP's 'register_globals' setting is enabled, an;unauthenticated attacker can exploit this issue to view arbitrary;files and execute arbitrary code, possibly taken from third-party;hosts, on the remote host.
Descripción:	Summary: The remote web server contains a PHP script that is affected by a remote file include issue. Description: The remote web server is running Segue CMS, an open source content management system tailored for educational institutions. The version of Segue CMS installed on the remote host fails to sanitize input to the 'themesdir' parameter before using it in the 'themes/program/themesettings.inc.php' script to include PHP code. Provided PHP's 'register_globals' setting is enabled, an unauthenticated attacker can exploit this issue to view arbitrary files and execute arbitrary code, possibly taken from third-party hosts, on the remote host. Solution: Update to version 1.5.9 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2006-5497 BugTraq ID: 20640 http://www.securityfocus.com/bid/20640 https://www.exploit-db.com/exploits/2600 http://www.osvdb.org/29904 http://secunia.com/advisories/22491 http://www.vupen.com/english/advisories/2006/4122 XForce ISS Database: seguecms-themesettings-file-include(29692) https://exchange.xforce.ibmcloud.com/vulnerabilities/29692
Copyright	Copyright (C) 2008 Justin Seitz

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.