PT-2007-6195 · Helplink · Helplink

Gold_M · Published 2007-09-26 · Updated 2017-10-19 · CVE-2007-5099

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Helplink version 0.1.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the file parameter in the show.php file.

Recommendations For Helplink version 0.1.0, update the show.php file to validate and sanitize the file parameter to prevent remote file inclusion attacks. As a temporary workaround, consider restricting access to the show.php file until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5099

Affected Products

Helplink

References · 6

• 🔥 https://exploit-db.com/exploits/4448 · Exploit
• http://secunia.com/advisories/26910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5099 · Security Note
• http://vupen.com/english/advisories/2007/3253 · Note
• http://securityfocus.com/bid/25782 · Note
• http://osvdb.org/37225 · Note