CVE-2010-2358 in Nakid CMS
Summary
by MITRE
PHP remote file inclusion vulnerability in modules/catalog/upload_photo.php in Nakid CMS 0.5.2, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the core[system_path] parameter. NOTE: some of these details are obtained from third party information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/25/2025
The vulnerability described in CVE-2010-2358 represents a critical remote code execution flaw within the Nakid CMS 0.5.2 content management system. This issue stems from improper input validation and sanitization within the modules/catalog/upload_photo.php script, which creates an exploitable condition that can be leveraged by remote attackers to execute arbitrary code on the target system. The vulnerability specifically manifests when the PHP configuration has magic_quotes_gpc disabled and register_globals enabled, creating a dangerous combination that allows attackers to inject malicious payloads through the core[system_path] parameter.
The technical exploitation of this vulnerability occurs through a remote file inclusion attack pattern that falls under CWE-88, which describes the injection of arguments into a system that are then processed as commands or code. The flaw exists because the application fails to properly validate or sanitize user-supplied input that is directly incorporated into system paths or file inclusion operations. When register_globals is enabled, variables from the HTTP request can be automatically imported into the global scope, making it possible for an attacker to manipulate the core[system_path] parameter to point to malicious remote files. This creates a classic remote file inclusion scenario where the application's trust in user input leads to arbitrary code execution.
The operational impact of this vulnerability is severe and multifaceted, representing a high-risk security issue that can lead to complete system compromise. Attackers can leverage this flaw to execute malicious code with the privileges of the web server process, potentially gaining access to sensitive data, modifying content, or establishing persistent backdoors. The vulnerability aligns with ATT&CK technique T1190, which describes the exploitation of remote services through file inclusion vulnerabilities. Depending on the system configuration and the privileges of the web server, successful exploitation could result in full system compromise, data exfiltration, or the establishment of a command and control channel that persists beyond the initial attack vector.
Mitigation strategies for this vulnerability must address both the immediate exploitation risk and the underlying configuration issues that make the attack possible. The primary recommendation involves disabling register_globals in the PHP configuration, which removes one of the critical prerequisites for exploitation. Additionally, administrators should ensure that magic_quotes_gpc is enabled or implement proper input validation and sanitization measures within the application code itself. The most effective long-term solution requires updating to a patched version of Nakid CMS or migrating to a more modern CMS platform that properly implements secure coding practices. Security measures should also include input validation at multiple layers, including web application firewalls that can detect and block suspicious URL parameters, and regular security audits to identify similar vulnerabilities in other components of the application stack.