8.5 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.322 Low
EPSS
Percentile
96.9%
Multiple PHP remote file inclusion vulnerabilities in Der Dirigent (DeDi) 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_dedi[dedi_path] parameter in (1) find.php, (2) insert_line.php, (3) fullscreen.php, (4) changecase.php, (5) insert_link.php, (6) insert_table.php, (7) table_cellprop.php, (8) table_prop.php, (9) table_rowprop.php, (10) insert_page.php, and possibly insert_marquee.php in backend/external/wysiswg/popups/.
CPE | Name | Operator | Version |
---|---|---|---|
der_dirigent:der_dirigent | der dirigent | eq | 1.0.3 |
packetstormsecurity.org/0610-exploits/Derdirigent.txt
secunia.com/advisories/22546
www.osvdb.org/29950
www.osvdb.org/29951
www.osvdb.org/29952
www.osvdb.org/29953
www.osvdb.org/29954
www.osvdb.org/29955
www.osvdb.org/29956
www.osvdb.org/29957
www.osvdb.org/29958
www.osvdb.org/29959
www.securityfocus.com/bid/20702
www.vupen.com/english/advisories/2006/4164
exchange.xforce.ibmcloud.com/vulnerabilities/29760