PT-2007-6159 · Unknown+2 · Open-Realty+5

Gold_M · Published 2007-09-24 · Updated 2017-09-29 · CVE-2007-5056

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ADODB Lite versions 1.42 and earlier

Description A code execution issue exists due to an eval injection vulnerability in the adodb-perf-module.inc.php file. This allows remote attackers to execute arbitrary code via PHP sequences in the last module parameter. The issue affects products that use ADOdb Lite, including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty.

Recommendations For ADOdb Lite versions 1.42 and earlier, consider disabling the last module parameter in the adodb-perf-module.inc.php file as a temporary workaround until a patch is available. Restrict access to the adodb-perf-module.inc.php file to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5056

Affected Products

Adodb Lite

Cms Made Simple

Journalness

Open-Realty

Pacercms

Sapid Cmf

References · 24

• 🔥 https://exploit-db.com/exploits/5090 · Exploit
• 🔥 https://exploit-db.com/exploits/5098 · Exploit
• 🔥 https://exploit-db.com/exploits/5097 · Exploit
• 🔥 http://attrition.org/pipermail/vim/2007-September/001800.html · Exploit
• 🔥 https://exploit-db.com/exploits/4442 · Exploit
• 🔥 https://exploit-db.com/exploits/5091 · Exploit
• http://secunia.com/advisories/28873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5056 · Security Note
• http://secunia.com/advisories/26928 · Vendor Advisory
• http://secunia.com/advisories/28874 · Vendor Advisory
• http://secunia.com/advisories/28886 · Vendor Advisory
• http://secunia.com/advisories/28859 · Vendor Advisory
• http://osvdb.org/41426 · Note
• http://osvdb.org/41422 · Note
• http://osvdb.org/41427 · Note