CVE-2009-0610

{"id": "CVE-2009-0610", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-02-17T17:30:06.030", "references": [{"url": "http://osvdb.org/51816", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/33814", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."}, {"lang": "es", "value": "Multiples vulnerabilidades de inyecci\u00f3n de c\u00f3digo est\u00e1tico en post.php en Simple PHP News v1.0 final permite a atacantes remotos inyectar c\u00f3digo PHP de su elecci\u00f3n dentro de news.txt a trav\u00e9s de (1) title o (2) par\u00e1metro \"date\". y entonces ejecutar el c\u00f3digo a trav\u00e9s de una petici\u00f3n directa a display.php. NOTA: la procedencia de esta informaci\u00f3n es desconocida; los detalles han sido obtenidos exclusivamente a partir de informaci\u00f3n de terceros."}], "lastModified": "2009-02-18T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dminnich:simple_php_news:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43ECAF21-1F05-4D68-A261-12A1B578F51C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}