CVE-2010-1926 in openCourrier
Summary
by MITRE
Directory traversal vulnerability in scr/soustab.php in openMairie openCourrier 2.02 and 2.03 beta, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069. NOTE: some of these details are obtained from third party information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2025
The vulnerability identified as CVE-2010-1926 represents a critical directory traversal flaw within the openMairie openCourrier 2.02 and 2.03 beta software systems. This weakness specifically affects the scr/soustab.php script and manifests when the PHP configuration parameter register_globals is enabled, creating a dangerous condition that enables remote attackers to manipulate file inclusion mechanisms. The vulnerability operates through the dsn[phptype] parameter, which accepts directory traversal sequences that can be exploited to access arbitrary local files on the server. This issue is categorized under CWE-22, which specifically addresses directory traversal vulnerabilities, and demonstrates the dangerous intersection of insecure file handling with PHP's register_globals functionality. The vulnerability is particularly concerning as it directly relates to CVE-2007-2069, indicating a pattern of similar weaknesses in related software components, suggesting systemic architectural flaws in how file paths are validated and processed.
The technical exploitation of this vulnerability occurs when an attacker crafts malicious input containing directory traversal sequences such as ../ or ..\ that manipulate the dsn[phptype] parameter in the scr/soustab.php script. When register_globals is enabled, the application's variable handling becomes vulnerable to manipulation, allowing attackers to inject arbitrary file paths that bypass normal input validation checks. The vulnerability stems from insufficient sanitization of user-supplied input, particularly in how the application processes the phptype parameter within the dsn array structure. This flaw enables attackers to traverse the file system hierarchy and potentially access sensitive files, configuration data, or system resources that should remain protected. The attack vector is particularly effective because it leverages the combination of PHP's register_globals feature with insecure parameter handling, creating multiple attack surfaces that can be exploited to achieve arbitrary code execution or information disclosure.
The operational impact of CVE-2010-1926 extends beyond simple information disclosure to encompass potential system compromise and unauthorized access to critical organizational data. When successfully exploited, the vulnerability allows remote attackers to include and execute arbitrary local files on the target system, potentially leading to complete system compromise. This vulnerability is particularly dangerous in web applications where user input is processed without proper validation, as it can be leveraged to access database configuration files, application source code, or system credentials. The presence of this vulnerability in openCourrier 2.02 and 2.03 beta versions indicates that organizations using these systems face significant risk, especially when deployed in environments where register_globals remains enabled. The vulnerability's relationship to CVE-2007-2069 suggests that similar patterns of insecure file handling exist across related software components, potentially creating a broader attack surface that extends beyond the immediate application scope. Organizations with systems running affected versions must consider the possibility of lateral movement attacks, where initial access through this vulnerability could lead to further compromise of network infrastructure.
The mitigation strategies for CVE-2010-1926 must address both the immediate vulnerability and underlying architectural issues that enabled its exploitation. The primary recommendation involves disabling the register_globals PHP configuration option, which directly eliminates one of the key conditions necessary for exploitation. Additionally, implementing proper input validation and sanitization mechanisms for all user-supplied parameters, particularly those used in file inclusion operations, is essential. The application should employ strict path validation that prevents directory traversal sequences from being processed, using techniques such as whitelisting acceptable values or implementing comprehensive regular expression filtering. Organizations should also consider implementing proper access controls and privilege separation to limit the damage that could occur if exploitation were to succeed. The vulnerability's classification under ATT&CK technique T1566, which covers phishing with malicious attachments, and T1059, which involves command and scripting interpreters, indicates that exploitation could lead to broader compromise through subsequent attack phases. Regular security audits and code reviews should specifically target file handling mechanisms and parameter validation to prevent similar vulnerabilities from being introduced in future development cycles.