PT-2007-5481 · Unknown · X-Script Guestbook

Ma$Ter-0F-De$A$T0R · Published 2007-08-09 · Updated 2025-01-17 · CVE-2007-4290

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Guestbook Script version 1.9

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the script root parameter to various PHP files, including 'delete.php', 'edit.php', 'inc/common.inc.php', 'database.php', 'entries.php', 'index.php', 'logout.php', and 'settings.php' in the 'admin/' directory.

Recommendations For Guestbook Script version 1.9, consider restricting access to the script root parameter in the affected PHP files to minimize the risk of exploitation. As a temporary workaround, restrict access to the vulnerable PHP files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-4290

Affected Products

X-Script Guestbook

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-4290 · Security Note
• http://securityfocus.com/archive/1/476010/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35876 · Note
• http://securityfocus.com/archive/1/475854/100/0/threaded · Note
• http://securityreason.com/securityalert/2988 · Note