PT-2007-1964 · None · Vote! Pro

R0Ut3R · Published 2007-01-26 · Updated 2017-10-19 · CVE-2007-0504

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vote! Pro version 4.0

Description The issue allows remote attackers to execute arbitrary code via the poll id parameter, which is supplied to an eval function call. This is due to an eval injection vulnerability in the poll frame.php script.

Recommendations For Vote! Pro version 4.0, avoid using the poll id parameter in the affected script until the issue is resolved. As a temporary workaround, consider restricting access to the poll frame.php script to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0504

Affected Products

Vote! Pro

References · 5

• 🔥 https://exploit-db.com/exploits/3180 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0504 · Security Note
• http://secunia.com/advisories/23834 · Note
• http://osvdb.org/31606 · Note
• http://vupen.com/english/advisories/2007/0300 · Note