RCE in Refbase

CVE-2015-7381

Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.032 (86.8th percentile) — read the EPSS interpretation.

Affected products

Refbase
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)