PT-2007-3269 · Phpcontact · Phpcontact

Published 2007-04-10 · Updated 2024-08-07 · CVE-2007-1924

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpContact (affected versions not specified)

Description The issue concerns remote file inclusion vulnerabilities in phpContact, potentially allowing remote attackers to execute arbitrary PHP code. This is achieved by manipulating the include path parameter in specific PHP files, namely contact business.php and contact person.php. However, it's noted that the include path is initialized to a fixed value before use, which disputes the vulnerability's impact.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-1924

Affected Products

Phpcontact

References · 4

• 🔥 http://attrition.org/pipermail/vim/2007-April/001495.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1924 · Security Note
• http://securityfocus.com/archive/1/464877/100/0/threaded · Note
• http://securityreason.com/securityalert/2528 · Note