CVE - CVE-2005-3519

CVE-ID
CVE-2005-3519	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the (1) INCLUDE_PATH and (2) SQUIZLIB_PATH parameters in new_upgrade_functions.php, (3) the INCLUDE_PATH parameter in init_mysource.php, and the PEAR_PATH parameter in (4) Socket.php, (5) Request.php, (6) Mail.php, (7) Date.php, (8) Span.php, (9) mimeDecode.php, and (10) mime.php.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:15133 URL:http://www.securityfocus.com/bid/15133/discuss BUGTRAQ:20051018 Secunia Research: MySource Cross-Site Scripting and File Inclusion URL:http://marc.info/?l=bugtraq&m=112966933202769&w=2 OSVDB:20035 URL:~~http://www.osvdb.org/20035~~ (Obsolete source) OSVDB:20036 URL:~~http://www.osvdb.org/20036~~ (Obsolete source) OSVDB:20037 URL:~~http://www.osvdb.org/20037~~ (Obsolete source) OSVDB:20038 URL:~~http://www.osvdb.org/20038~~ (Obsolete source) OSVDB:20039 URL:~~http://www.osvdb.org/20039~~ (Obsolete source) OSVDB:20040 URL:~~http://www.osvdb.org/20040~~ (Obsolete source) OSVDB:20041 URL:~~http://www.osvdb.org/20041~~ (Obsolete source) OSVDB:20042 URL:~~http://www.osvdb.org/20042~~ (Obsolete source) OSVDB:20043 URL:~~http://www.osvdb.org/20043~~ (Obsolete source) SECTRACK:1015075 URL:http://securitytracker.com/id?1015075 SECUNIA:16946 URL:http://secunia.com/advisories/16946/ SREASON:92 URL:http://securityreason.com/securityalert/92 VUPEN:ADV-2005-2132 URL:~~http://www.vupen.com/english/advisories/2005/2132~~ (Obsolete source) XF:mysource-multiple-file-include(22772) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/22772
Assigning CNA
MITRE Corporation
Date Record Created
20051106	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20051106)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)