PT-2007-6705 · Profilecms · Profilecms

R00T · Published 2007-10-30 · Updated 2017-09-29 · CVE-2007-5720

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProfileCMS version 1.0

Description The issue allows remote attackers to upload and execute arbitrary PHP code. This is achieved through unspecified vectors involving the creation of a profile in the profiles script.

Recommendations For ProfileCMS version 1.0, consider restricting or disabling the profiles script to prevent the upload and execution of arbitrary PHP code until a fix is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5720

Affected Products

Profilecms

References · 5

• 🔥 https://exploit-db.com/exploits/4586 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5720 · Security Note
• http://osvdb.org/45297 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38185 · Note
• http://securityfocus.com/bid/26242 · Note