PT-2007-2809 · Pmb · Pmb Services
K-159
+1
·
Published
2007-03-12
·
Updated
2018-10-16
·
CVE-2007-1415
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PMB Services versions 3.0.13 and earlier
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL in various parameters, including the
class path parameter to files such as includes/resa func.inc.php, admin/notices/perso.inc.php, and admin/quotas/main.inc.php, the base path parameter to files like opac css/rec panier.php and opac css/includes/author see.inc.php, and the include path parameter to multiple files across different directories.Recommendations
For PMB Services versions 3.0.13 and earlier, consider disabling the
class path, base path, and include path parameters in the affected files until a patch is available. Restrict access to the vulnerable files, such as includes/resa func.inc.php, admin/notices/perso.inc.php, admin/quotas/main.inc.php, opac css/rec panier.php, and opac css/includes/author see.inc.php, to minimize the risk of exploitation. Avoid using the class path, base path, and include path parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pmb Services