RCE in Mundi King Mail
CVE-2009-2095
PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the top parameter. NOTE: when allow_url_fopen is disabled, directory traversal attacks are possible to include and execute arbitrary local files.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.017 (75.4th percentile) — read the EPSS interpretation.
Affected products
- Mundi_king Mundi_mail — versions 0.8.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)