CVE-2010-1927 in openCourrier
Summary
by MITRE
Multiple PHP remote file inclusion vulnerabilities in openMairie openCourrier 2.02 and 2.03 beta, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) bible.class.php, (2) dossier.class.php, (3) service.class.php, (4) collectivite.class.php, (5) droit.class.php, (6) tache.class.php, (7) emetteur.class.php, (8) utilisateur.class.php, (9) courrier.recherche.tab.class.php, and (10) profil.class.php in obj/. NOTE: some of these details are obtained from third party information.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2025
The vulnerability identified as CVE-2010-1927 represents a critical remote file inclusion flaw affecting openMairie openCourrier versions 2.02 and 2.03 beta. This vulnerability specifically exploits the insecure handling of user-supplied input when the PHP configuration parameter register_globals is enabled, creating a pathway for remote attackers to execute arbitrary code on the affected system. The flaw manifests through the path_om parameter which is processed in multiple class files within the obj/ directory, including bible.class.php, dossier.class.php, and several other core system components. The vulnerability's severity is amplified by the fact that it affects multiple entry points within the application's object-oriented architecture, providing attackers with numerous potential attack vectors.
The technical mechanism behind this vulnerability aligns with CWE-88, which describes improper neutralization of special elements used in an expression, specifically the manipulation of PHP's register_globals functionality. When register_globals is enabled, PHP automatically creates global variables from HTTP request data, including GET, POST, and COOKIE parameters. Attackers can exploit this by crafting malicious URLs that include the path_om parameter with a remote file URL, such as http://evil.com/shell.php, which gets included and executed as PHP code. The vulnerability exists because the application fails to properly validate or sanitize the path_om parameter before including it in the system, creating an unrestricted file inclusion condition that allows attackers to execute arbitrary code with the privileges of the web server.
The operational impact of this vulnerability is significant, as it provides attackers with complete system compromise capabilities. An attacker can leverage this vulnerability to execute malicious code remotely, potentially gaining access to sensitive data, modifying system files, or establishing persistent backdoors. The attack surface is broad due to the vulnerability affecting ten different class files, meaning that even if one attack vector is patched, others remain exploitable. This vulnerability directly maps to several ATT&CK techniques including T1190 for exploitation of remote services and T1059 for command and scripting interpreter usage, as attackers can execute arbitrary commands through the included PHP files.
Mitigation strategies for this vulnerability should focus on immediate patching of the affected openMairie openCourrier versions, as well as implementing proper input validation and sanitization. Organizations should disable register_globals in their PHP configurations, which is a fundamental security measure that prevents the automatic creation of global variables from HTTP request data. Additionally, implementing proper parameter validation and using include functions with whitelisted values rather than user-supplied input can prevent such vulnerabilities. Network-based mitigations such as web application firewalls and intrusion prevention systems can help detect and block malicious requests containing suspicious URL patterns. The vulnerability also underscores the importance of secure coding practices, particularly in applications that handle user input, and demonstrates the critical need for proper parameter validation and the principle of least privilege in web application development.