Test ID:	1.3.6.1.4.1.25623.1.0.80085
Category:	Web application abuses
Title:	Segue CMS themesdir Parameter Remote File Include Vulnerability
Summary:	The remote web server contains a PHP script that is affected by a;remote file include issue.;;Description:;;The remote web server is running Segue CMS, an open source content;management system tailored for educational institutions.;;The version of Segue CMS installed on the remote host fails to;sanitize input to the 'themesdir' parameter before using it in the;'themes/program/themesettings.inc.php' script to include PHP code.;Provided PHP's 'register_globals' setting is enabled, an;unauthenticated attacker can exploit this issue to view arbitrary;files and execute arbitrary code, possibly taken from third-party;hosts, on the remote host.
Description:	Summary: The remote web server contains a PHP script that is affected by a remote file include issue. Description: The remote web server is running Segue CMS, an open source content management system tailored for educational institutions. The version of Segue CMS installed on the remote host fails to sanitize input to the 'themesdir' parameter before using it in the 'themes/program/themesettings.inc.php' script to include PHP code. Provided PHP's 'register_globals' setting is enabled, an unauthenticated attacker can exploit this issue to view arbitrary files and execute arbitrary code, possibly taken from third-party hosts, on the remote host. Solution: Update to version 1.5.9 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-5497 BugTraq ID: 20640 http://www.securityfocus.com/bid/20640 https://www.exploit-db.com/exploits/2600 http://www.osvdb.org/29904 http://secunia.com/advisories/22491 http://www.vupen.com/english/advisories/2006/4122 XForce ISS Database: seguecms-themesettings-file-include(29692) https://exchange.xforce.ibmcloud.com/vulnerabilities/29692
Copyright	Copyright (C) 2008 Justin Seitz

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.