PT-2007-6619 · Awrate · Awrate

Arfis · Published 2007-10-19 · Updated 2008-11-15 · CVE-2007-5599

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions awrate version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to specific PHP files, such as "404.php" or "topbar.php".

Recommendations For awrate version 1.0, consider restricting access to the toroot parameter in the affected PHP files until a patch is available. As a temporary workaround, avoid using the toroot parameter in the "404.php" and "topbar.php" files to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5599

Affected Products

Awrate

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5599 · Security Note
• http://securityfocus.com/bid/26336 · Note
• http://arfis.wordpress.com/2007/09/13/rfi-02-awratecom-message-board · Note
• http://osvdb.org/45528 · Note
• http://osvdb.org/45529 · Note