CVE-2012-1199

Basic Analysis and Security Engine (BASE) 1.4.5 sürümündeki birden fazla PHP uzaktan dosya dahil etme (remote file inclusion) zafiyeti, uzak saldırganların şu parametreler üzerinden bir URL aracılığıyla rastgele PHP kodu çalıştırmasına olanak tanır: (1) base_ag_main.php'deki BASE_path parametresi, (2) base_db_setup.php, (3) base_graph_common.php, (4) base_graph_display.php, (5) base_graph_form.php, (6) base_graph_main.php, (7) base_local_rules.php, (8) base_logout.php, (9) base_main.php, (10) base_maintenance.php, (11) base_payload.php, (12) base_qry_alert.php, (13) base_qry_common.php, (14) base_qry_main.php, (15) base_stat_alerts.php, (16) base_stat_class.php, (17) base_stat_common.php, (18) base_stat_ipaddr.php, (19) base_stat_iplink.php, (20) base_stat_ports.php, (21) base_stat_sensor.php, (22) base_stat_time.php, (23) base_stat_uaddr.php, (24) base_user.php, (25) index.php, (26) admin/base_roleadmin.php, (27) admin/base_useradmin.php, (28) admin/index.php, (29) help/base_setup_help.php, (30) includes/base_action.inc.php, (31) includes/base_cache.inc.php, (32) includes/base_db.inc.php, (33) includes/base_db.inc.php, (34) includes/base_include.inc.php, (35) includes/base_output_html.inc.php, (36) includes/base_output_query.inc.php, (37) includes/base_state_criteria.inc.php, (38) includes/base_state_query.inc.php veya (39) setup/base_conf_contents.php; (40) includes/base_state_common.inc.php'ye ait GLOBALS[user_session_path] parametresi; (41) setup/base_conf_contents.php'ye ait BASE_Language parametresi veya (42) setup/setup2.php'ye ait ado_inc_php parametresi.