Lucene search

[email protected]CVE-2007-2988

HistoryJun 01, 2007 - 10:30 a.m.

CVE-2007-2988

2007-06-0110:30:00

[email protected]

web.nvd.nist.gov

inout meta search engine

cve-2007-2988

admin script

remote attackers

php code

security vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

AI Score

Confidence

High

0.11 Low

EPSS

Percentile

95.2%

JSON

A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/create_engine.php followed by a request to admin/generate_tabs.php.

Affected configurations

NVD

Node

inout_scriptsinout_meta_search_engine

CPENameOperatorVersion
inout_scripts:inout_meta_search_engineinout scripts inout meta search engineeq*

CPE	Name	Operator	Version
inout_scripts:inout_meta_search_engine	inout scripts inout meta search engine	eq	*

References

osvdb.org/42034

securityreason.com/securityalert/2763

www.securityfocus.com/archive/1/469808/100/0/threaded

www.securityfocus.com/bid/24189

www.securityfocus.com/bid/24199

exchange.xforce.ibmcloud.com/vulnerabilities/34563

www.exploit-db.com/exploits/4004

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

AI Score

Confidence

High

0.11 Low

EPSS

Percentile

95.2%

JSON

Related for CVE-2007-2988

nvd1 prion1 cvelist1