CVE-2010-1978

FreePHPBlogSoftware 1.0 - Remote Code Execution via phpincdir Parameter

Title source: llm
STIX 2.1

Description

PHP remote file inclusion vulnerability in default_theme.php in FreePHPBlogSoftware 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the phpincdir parameter. NOTE: some of these details are obtained from third party information.

References (5)

Core 5
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/12063
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39321
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/57560
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/63558
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/39233

Scores

EPSS 0.0134
EPSS Percentile 67.8%

Details

CWE
CWE-94
Status published
Products (1)
freephpblogsoftware/freephpblogsoftware 1.0
Published May 19, 2010
Tracked Since Feb 18, 2026