Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2012-1199

Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbi

Published
Last modified
published
Not listed in CISA KEV
38 on Exploit-DB

Summary

Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) BASE_path parameter to base_ag_main.php, (2) base_db_setup.php, (3) base_graph_common.php, (4) base_graph_display.php, (5) base_graph_form.php, (6) base_graph_main.php, (7) base_local_rules.php, (8) base_logout.php, (9) base_main.php, (10) base_maintenance.php, (11) base_payload.php, (12) base_qry_alert.php, (13) base_qry_common.php, (14) base_qry_main.php, (15) base_stat_alerts.php, (16) base_stat_class.php, (17) base_stat_common.php, (18) base_stat_ipaddr.php, (19) base_stat_iplink.php, (20) base_stat_ports.php, (21) base_stat_sensor.php, (22) base_stat_time.php, (23) base_stat_uaddr.php, (24) base_user.php, (25) index.php, (26) admin/base_roleadmin.php, (27) admin/base_useradmin.php, (28) admin/index.php, (29) help/base_setup_help.php, (30) includes/base_action.inc.php, (31) includes/base_cache.inc.php, (32) includes/base_db.inc.php, (33) includes/base_db.inc.php, (34) includes/base_include.inc.php, (35) includes/base_output_html.inc.php, (36) includes/base_output_query.inc.php, (37) includes/base_state_criteria.inc.php, (38) includes/base_state_query.inc.php or (39) setup/base_conf_contents.php; (40) GLOBALS[user_session_path] parameter to includes/base_state_common.inc.php; (41) BASE_Language parameter to setup/base_conf_contents.php; or (42) ado_inc_php parameter to setup/setup2.php.

Timeline

  1. Public exploit on Exploit-DB

    EDB-36758, EDB-36759, EDB-36712, EDB-36713, EDB-36714, EDB-36715, EDB-36716, EDB-36717, EDB-36718, EDB-36722, EDB-36719, EDB-36720, EDB-36721, EDB-36723, EDB-36724, EDB-36702, EDB-36703, EDB-36704, EDB-36705, EDB-36706, EDB-36707, EDB-36708, EDB-36709, EDB-36710, EDB-36711, EDB-36725, EDB-36726, EDB-36727, EDB-36728, EDB-36729, EDB-36730, EDB-36731, EDB-36732, EDB-36752, EDB-36753, EDB-36754, EDB-36755, EDB-36757

  2. CVE published
  3. Record last updated

Affected versions

  • n/a n/a

    Version range not reported

References 41

securityfocus.com

exchange.xforce.ibmcloud.com

packetstormsecurity.org

Exploit-DB