Lucene search

MitreCVE-2007-2677

HistoryMay 14, 2007 - 11:19 p.m.

CVE-2007-2677

2007-05-1423:19:00

mitre

web.nvd.nist.gov

cve

2007

2677

php

remote file inclusion

vulnerabilities

phpchess

community edition 2.0

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.6

Confidence

Low

EPSS

0.203

Percentile

96.4%

JSON

Multiple PHP remote file inclusion vulnerabilities in phpChess Community Edition 2.0 allow remote attackers to execute arbitrary PHP code via a URL in (1) the config parameter to includes/language.php, or the Root_Path parameter to (2) layout_admin_cfg.php, (3) layout_cfg.php, or (4) layout_t_top.php in skins/phpchess/. NOTE: vector 1 has been disputed by CVE, since the code is defined within a function that is not called from within includes/language.php.

Affected configurations

Nvd

Node

phpchessphpchessMatch2.0community

VendorProductVersionCPE
phpchessphpchess2.0cpe:2.3:a:phpchess:phpchess:2.0:*:community:*:*:*:*:*

Vendor	Product	Version	CPE
phpchess	phpchess	2.0	cpe:2.3:a:phpchess:phpchess:2.0::community:::::

References

attrition.org/pipermail/vim/2007-May/001586.html

osvdb.org/35592

osvdb.org/35593

osvdb.org/35594

osvdb.org/35595

secunia.com/advisories/25147

www.securityfocus.com/bid/23797

www.vupen.com/english/advisories/2007/1649

exchange.xforce.ibmcloud.com/vulnerabilities/34056

www.exploit-db.com/exploits/3837

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.6

Confidence

Low

EPSS

0.203

Percentile

96.4%

JSON

Related for CVE-2007-2677