CVE-2010-2618

EPSS 2.1%

PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter. NOTE: it was later reported that 2.0.1 is also affected.

Affected products

n/a · n/a

public PoCs found — 5

cve_referencepacketstormsecurity.org/1006-exploits/adaptcms200-rfi.txtunverified cve_referencewww.exploit-db.com/exploits/14016unverified cve_referencewww.exploit-db.com/exploits/15237unverified exploitdbwww.exploit-db.com/exploits/14016unverified exploitdbwww.exploit-db.com/exploits/15237unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.org/1006-exploits/adaptcms200-rfi.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/59752 http://www.exploit-db.com/exploits/14016 http://www.exploit-db.com/exploits/15237 http://www.securityfocus.com/bid/41116