CVE-2009-3660

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-10-11 · updated 2026-06-16
Weakness: CWE-94

Description

PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.

Affected products

Efrontlearning Efront: through 3.5.4; 3.1.0, 3.1.2, 3.1.3, 3.1.4, 3.5.0, 3.5.0-beta1 (+4)

References

http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174
http://www.exploit-db.com/exploits/9681
http://www.securityfocus.com/bid/36411
http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174
http://www.exploit-db.com/exploits/9681
http://www.securityfocus.com/bid/36411

Get alerted when CVE-2009-3660 or the next vulnerability affects your stack