PT-2007-6064 · Phportal · Phportal

Published 2007-09-18 · Updated 2024-08-07 · CVE-2007-4950

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPortal version 0.2.7

Description A remote file inclusion issue in form/db form/employee.php allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT ROOT parameter. However, it is noted that this issue is disputed since the DOCUMENT ROOT cannot be modified by an attacker.

Recommendations For PHPortal version 0.2.7, as a temporary workaround, consider restricting access to the form/db form/employee.php file until a patch is available. Avoid using the DOCUMENT ROOT parameter in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-4950

Affected Products

Phportal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-4950 · Security Note
• http://arfis.wordpress.com/2007/09/14/rfi-03-phportal · Note
• https://t.me/cvenotify/89716 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42477 · Note
• http://securityfocus.com/bid/25717 · Note