PT-2008-1578 · Phpautovideo · Phpautovideo

Mhz91 · Published 2008-01-03 · Updated 2017-10-19 · CVE-2007-6615

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpAutoVideo version 2.21

Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using directory traversal sequences in the selected provider parameter.

Recommendations For phpAutoVideo version 2.21, consider restricting access to the includes/block.php file until a patch is available. As a temporary workaround, avoid using the selected provider parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-6615

Affected Products

Phpautovideo

References · 7

• 🔥 https://exploit-db.com/exploits/4782 · Exploit
• 🔥 http://securityfocus.com/bid/27023 · Exploit
• http://secunia.com/advisories/28230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6615 · Security Note
• http://vupen.com/english/advisories/2007/4319 · Note
• http://osvdb.org/39618 · Note
• http://forums.agaresmedia.com/viewtopic.php?f=13&t=407 · Note