PT-2007-3744 · Sphider · Sphider

Published

2007-05-01

·

Updated

2024-08-07

·

CVE-2007-2411

Report an issue
CVSS v2.0
7.5
VectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions:

Sphider versions 1.2.x

Description:

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `include dir` parameter in the index.php file. A third party disputes this issue, stating that the application is not vulnerable.

Recommendations:

For Sphider versions 1.2.x, as a temporary workaround, consider restricting access to the `include dir` parameter in the index.php file until the issue is resolved.

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2411

Affected Products

Sphider