PT-2007-6048 · Php · Phpffl

Dj7Xpl · Published 2007-09-18 · Updated 2017-09-29 · CVE-2007-4934

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: phpFFL version 1.24

Description: The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by providing a URL in the PHPFFL FILE ROOT parameter to specific API endpoints, such as "program files/livedraft/livedraft.php" or "program files/livedraft/admin.php".

Recommendations: For phpFFL version 1.24, consider restricting access to the livedraft.php and admin.php files in the program files/livedraft directory to minimize the risk of exploitation. Avoid using the PHPFFL FILE ROOT parameter with untrusted input until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-4934

Affected Products

Phpffl

References · 11

• 🔥 http://securityfocus.com/bid/25667 · Exploit
• 🔥 https://exploit-db.com/exploits/4406 · Exploit
• http://sourceforge.net/project/shownotes.php?release_id=539716&group_id=137531 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-4934 · Security Note
• http://vupen.com/english/advisories/2007/3176 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36606 · Note
• http://sourceforge.net/forum/forum.php?forum_id=735906 · Note
• http://osvdb.org/37085 · Note
• http://osvdb.org/37086 · Note
• http://arfis.wordpress.com/2007/09/14/rfi-02-phpffl-fantasy-football-league-manager · Note
• http://secunia.com/advisories/26812 · Note