PT-2007-6586 · Phpcms · Phpscms

Arfis · Publicado 2007-10-18 · Atualizado 2025-01-17 · CVE-2007-5565

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpSCMS versions 0.0.1-Alpha1

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter in the includes/functions.php file. This is a remote file inclusion issue. Note that the identified code is in a function that is not accessible via direct request, which is disputed by some sources.

Recommendations For phpSCMS version 0.0.1-Alpha1, as a temporary workaround, consider restricting access to the includes/functions.php file or the dir parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-5565

Produtos afetados

Phpscms

Referências · 3

• http://arfis.wordpress.com/2007/09/13/rfi-02-phpscms · Nota
• https://t.me/cvenotify/89729 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2007-5565 · Nota de Segurança