CVE-2015-7381
HighSummary
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary PHP code via the pathToMYSQL or databaseStructureFile parameters.
Risk Assessment
Attackers can exploit these vulnerabilities to execute remote code, potentially leading to system compromise and data leakage.
Recommendation
It is recommended to update to the latest version of the software and review and secure input parameters in the install.php file.
Other vulnerabilities in Web Reference Database (refbase) version 0.9.6
See all- CVE-2015-7382High
SQL injection vulnerability in install.php in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter.
- CVE-2015-6009High
Multiple SQL injection vulnerabilities in Web Reference Database (refbase) version 0.9.6 allow remote attackers to execute arbitrary SQL commands via the 'where' parameter in rss.php or the 'sqlQuery' parameter in search.php.
- CVE-2015-6008High
The install.php file in Web Reference Database (refbase) version 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, posing a serious security risk.
Original NVD description (English source)
Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.