PT-2007-6586 · Phpcms · Phpscms

Arfis · Published 2007-10-18 · Updated 2025-01-17 · CVE-2007-5565

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpSCMS versions 0.0.1-Alpha1

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter in the includes/functions.php file. This is a remote file inclusion issue. Note that the identified code is in a function that is not accessible via direct request, which is disputed by some sources.

Recommendations For phpSCMS version 0.0.1-Alpha1, as a temporary workaround, consider restricting access to the includes/functions.php file or the dir parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5565

Affected Products

Phpscms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2007-5565 · Security Note
• http://arfis.wordpress.com/2007/09/13/rfi-02-phpscms · Note
• https://t.me/cvenotify/89729 · Telegram Post