PT-2007-6253 · Thierry Leriche · Thierry Leriche Remasys
Arfis
·
Published
2007-10-01
·
Updated
2008-09-05
·
CVE-2007-5160
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Thierry Leriche Restaurant Management System (ReMaSys) version 0.5
Description
The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via a URL in the
DIR ROOT parameter to "global.php", or the DIR PAGE parameter to "template/fr/page.php" or "page/fr/boxConnection.php".Recommendations
For version 0.5, as a temporary workaround, consider restricting access to the
global.php, template/fr/page.php, and page/fr/boxConnection.php files until a patch is available. Avoid using the DIR ROOT and DIR PAGE parameters in the affected files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Thierry Leriche Remasys