PT-2007-3915 · Aforum · Aforum

The Tiger · Published 2007-05-11 · Updated 2017-10-11 · CVE-2007-2596

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aForum versions 1.32 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the CommonAbsDir parameter. This can be achieved by manipulating the URL to include malicious PHP code, which can then be executed by the server.

Recommendations For aForum versions 1.32 and earlier, update to a version later than 1.32 to resolve the issue. As a temporary workaround, consider restricting access to the common/func.php file to minimize the risk of exploitation. Avoid using the CommonAbsDir parameter in URLs until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-2596

Affected Products

Aforum

References · 7

• 🔥 https://exploit-db.com/exploits/3884 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2596 · Security Note
• http://secunia.com/advisories/25224 · Note
• http://vupen.com/english/advisories/2007/1739 · Note
• http://securityfocus.com/bid/23902 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34202 · Note
• http://osvdb.org/35907 · Note