PT-2007-3955 · Phptodo · Phptodo

Published 2007-05-13 · Updated 2017-07-29 · CVE-2007-2636

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpTodo versions prior to 0.8.1

Description The issue allows remote attackers to have an unknown impact via newlines in regular expressions. This can be achieved through several files, including "index.php", "feed.php", "prefs.php", "todolist.php", "classTodoItem.php", and "phpTodoUser.php" in the libs/ directory.

Recommendations For versions prior to 0.8.1, update to version 0.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected files until the update is applied. Avoid using newlines in regular expressions in the affected API endpoints, such as "index.php", "feed.php", "prefs.php", and "todolist.php", until the issue is resolved.

Fix

Related Identifiers

CVE-2007-2636

Affected Products

Phptodo

References · 5

• http://phptodo.godshell.com/ChangeLog · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-2636 · Security Note
• http://securityfocus.com/bid/23928 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34275 · Note
• http://vupen.com/english/advisories/2007/1774 · Note