openMairie openCimetiere contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'obj/entreprise.class.php' script not properly sanitizing user input supplied to the 'path_om' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.

OSVDB is not aware of a solution for this vulnerability.

• Exploit Database: 12476
• CVE ID: 2010-1944 (see also: NVD)
• Secunia Advisory ID: 39687
• Bugtraq ID: 39883
• ISS X-Force ID: 58267
• Related OSVDB ID: 64223 64224 64225 64226 64227 64228 64229 64230 64231 64232 64233 64234 64235 64236 64238 64239 64240 64241 64242 64243 64244 64245
• VUPEN Advisory: ADV-2010-1050
• Vendor URL: http://openmairie.org/demonstration/population/opencimetiere-1/opencimetiere
• Other Advisory URL: http://packetstormsecurity.org/1005-exploits/opencimetiere-rfi.txt

• cr4wl3r - Inj3ct0r Team