CVE-2010-1920

OpenMairie openAnnuaire 2.00 - Remote File Inclusion via dsn[phptype] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-1920. PoCs published by cr4wl3r.

AI-analyzed exploit summary This exploit demonstrates RFI (Remote File Inclusion) and LFI (Local File Inclusion) vulnerabilities in Openannuaire Openmairie Annuaire 2.00. It provides multiple endpoints where an attacker can include remote or local files by manipulating the 'path_om' or 'dsn[phptype]' parameters.

Description

Directory traversal vulnerability in scr/soustab.php in OpenMairie openAnnuaire 2.00, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.

Exploits (1)

exploitdb WORKING POC VERIFIED

by cr4wl3r · textwebappsphp

https://www.exploit-db.com/exploits/12486

View Code ZIP pw:eip

This exploit demonstrates RFI (Remote File Inclusion) and LFI (Local File Inclusion) vulnerabilities in Openannuaire Openmairie Annuaire 2.00. It provides multiple endpoints where an attacker can include remote or local files by manipulating the 'path_om' or 'dsn[phptype]' parameters.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Openannuaire Openmairie Annuaire 2.00

No auth needed

Prerequisites: Access to the target web application · Ability to host a malicious file for RFI

MITRE ATT&CK