Test ID:	1.3.6.1.4.1.25623.1.0.20972
Category:	Web application abuses
Title:	Plume CMS <= 1.0.2 Remote File Inclusion Vulnerability
Summary:	Plume CMS is prone to local and remote file inclusion vulnerabilities.
Description:	Summary: Plume CMS is prone to local and remote file inclusion vulnerabilities. Vulnerability Insight: The version installed does not sanitize user input in the '_PX_config[manager_path]' parameter in the 'prepend.php' file. This allows an attacker to include arbitrary files and execute code on the system. This flaw is exploitable if PHP's register_globals is enabled. Solution: Either sanitize the prepend.php file as advised by the developer (see references) or update to Plume CMS version 1.0.3 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-0725 BugTraq ID: 16662 http://www.securityfocus.com/bid/16662 http://www.osvdb.org/23204 http://securitytracker.com/id?1015624 http://secunia.com/advisories/18883 http://www.vupen.com/english/advisories/2006/0599 XForce ISS Database: plumecms-frontinc-prepend-file-include(27699) https://exchange.xforce.ibmcloud.com/vulnerabilities/27699 XForce ISS Database: plumecms-prepend-file-include(24697) https://exchange.xforce.ibmcloud.com/vulnerabilities/24697
Copyright	Copyright (C) 2006 Ferdy Riphagen

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.