PT-2007-6489 · Php · Php-Stats

Egix · Published 2007-10-14 · Updated 2017-09-29 · CVE-2007-5453

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Php-Stats version 0.1.9.2

Description: The issue allows remote authenticated administrators to execute arbitrary code by injecting PHP sequences into the php-stats-options record in the options table. This is used in an eval function call by files such as admin.php, click.php, and download.php. The injection can be achieved by modifying options through a backup restore action in admin.php.

Recommendations: For Php-Stats version 0.1.9.2, consider restricting access to the admin.php file and other affected files to prevent remote authenticated administrators from exploiting the eval injection vulnerability. As a temporary workaround, avoid using the backup restore action in admin.php until a fix is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5453

Affected Products

Php-Stats

References · 4

• 🔥 https://exploit-db.com/exploits/4513 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5453 · Security Note
• http://securityfocus.com/bid/26022 · Note
• http://osvdb.org/43480 · Note