PT-2007-3321 · Xoops+1 · Virii Info+1

Published 2007-04-12 · Updated 2024-08-07 · CVE-2007-1976

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xoops module Virii Info versions 1.10 and earlier

Description A remote file inclusion issue in the index.php file of the Virii Info module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root path] parameter. However, it has been noted that the application's checkSuperglobals function may defend against this attack.

Recommendations For Xoops module Virii Info versions 1.10 and earlier, consider disabling the index.php file or restricting access to it until a patch or further clarification on the issue is available. As a temporary workaround, review and potentially modify the checkSuperglobals function to ensure it effectively prevents remote file inclusion attacks.

Exploit

Fix

Related Identifiers

CVE-2007-1976

Affected Products

Virii Info

Xoops

References · 7

• 🔥 https://exploit-db.com/exploits/3642 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1976 · Security Note
• http://attrition.org/pipermail/vim/2007-April/001489.html · Note
• http://attrition.org/pipermail/vim/2007-April/001490.html · Note
• http://vupen.com/english/advisories/2007/1206 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33368 · Note
• http://osvdb.org/37429 · Note