Lucene search

MitreCVE-2007-1924

HistoryApr 10, 2007 - 11:19 p.m.

CVE-2007-1924

2007-04-1023:19:00

mitre

web.nvd.nist.gov

cve

php

remote file inclusion

vulnerabilities

phpcontact

url

arbitrary code execution

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.6

Confidence

Low

EPSS

0.008

Percentile

82.3%

JSON

Multiple PHP remote file inclusion vulnerabilities in phpContact allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) contact_business.php or (2) contact_person.php. NOTE: this issue is disputed by CVE and a reliable third party, because include_path is initialized to a fixed value before use

Affected configurations

Nvd

Node

phpcontactphpcontact

VendorProductVersionCPE
phpcontactphpcontact*cpe:2.3:a:phpcontact:phpcontact:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phpcontact	phpcontact	*	cpe:2.3:a:phpcontact:phpcontact::::::::

References

securityreason.com/securityalert/2528

www.attrition.org/pipermail/vim/2007-April/001495.html

www.securityfocus.com/archive/1/464877/100/0/threaded

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.6

Confidence

Low

EPSS

0.008

Percentile

82.3%

JSON

Related for CVE-2007-1924