CVE-2016-10082

Critical

Published: 30/12/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The file include/functions_installer.inc.php in Serendipity up to version 2.0.5 is vulnerable to File Inclusion and possible Code Execution attacks during first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious code, potentially leading to system compromise. Organizations should be aware of the risks associated with unauthorized access to the system.

Recommendation

It is recommended to update Serendipity to the latest version to mitigate this vulnerability. Additionally, proper input sanitization mechanisms should be implemented in the application.

Original NVD description (English source)

include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call in the bundled-libs/serendipity_generateFTPChecksums.php file.