PT-2007-5661 · Php · Php

Published 2007-08-22 · Updated 2018-10-15 · CVE-2007-4485

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Butterfly online visitors counter version 1.08

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the SERVER[DOCUMENT ROOT] parameter, specifically in the visitor.php file. This is possible when used with certain older versions of PHP that have improper SERVER superglobal handling.

Recommendations For Butterfly online visitors counter version 1.08, consider updating PHP to a version that properly handles the SERVER superglobal to mitigate the risk of exploitation. As a temporary workaround, restrict access to the visitor.php file to minimize the risk of arbitrary PHP code execution. Avoid using the SERVER[DOCUMENT ROOT] parameter in the affected visitor.php file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-4485

Affected Products

Php

References · 7

• 🔥 http://securityvulns.com/Rdocument845.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4485 · Security Note
• http://securityfocus.com/archive/1/477253/100/0/threaded · Note
• http://securityvulns.com/source26994.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36147 · Note
• http://osvdb.org/38327 · Note
• http://securityfocus.com/archive/1/482006/100/0/threaded · Note