PT-2007-5470 · Frontaccounting · Frontaccounting

Kezzap66345 · Published 2007-08-09 · Updated 2024-08-07 · CVE-2007-4279

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FrontAccounting version 1.12 Build 31

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the path to root parameter in the config.php file.

Recommendations For FrontAccounting version 1.12 Build 31, consider restricting access to the config.php file and avoid using the path to root parameter in URLs until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-4279

Affected Products

Frontaccounting

References · 9

• 🔥 https://exploit-db.com/exploits/4269 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4279 · Security Note
• http://secunia.com/advisories/26350 · Vendor Advisory
• http://arfis.wordpress.com/2007/09/14/rfi-02-frontaccounting · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35873 · Note
• http://vupen.com/english/advisories/2007/2809 · Note
• http://osvdb.org/36431 · Note
• https://t.me/cvenotify/89721 · Telegram Post
• http://securityfocus.com/bid/25229 · Note