Lucene search

MitreCVE-2007-5146

HistoryOct 01, 2007 - 5:17 a.m.

CVE-2007-5146

2007-10-0105:17:00

CWE-94

mitre

web.nvd.nist.gov

cve

2007

5146

php

remote

file inclusion

dedi-group

der dirigent

vulnerability

execute

arbitrary

code

url

parameter

backend

frontend

filemanager

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON

Multiple PHP remote file inclusion vulnerabilities in dedi-group Der Dirigent 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the dedi_path parameter to (1) inc.generate_code.php, (2) fnc.type_forms.php, or (3) fnc.type.php in backend/inc/, or (4) frontend.php or (5) backend.php in projekt01/cms/inc/; or (6) the this_dir parameter to backend/inc/class.filemanager.php. NOTE: vectors 4 and 5 are disputed by CVE because PHP encounters a fatal function-call error on a direct request for the file, before reaching the include statement.

Affected configurations

Nvd

Node

der_dirigentder_dirigentMatch1.0

VendorProductVersionCPE
der_dirigentder_dirigent1.0cpe:2.3:a:der_dirigent:der_dirigent:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
der_dirigent	der_dirigent	1.0	cpe:2.3:a:der_dirigent:der_dirigent:1.0:::::::*

References

arfis.wordpress.com/2007/09/14/rfi-02-der-dirigent/

osvdb.org/45535

osvdb.org/45536

osvdb.org/45537

osvdb.org/45538

osvdb.org/45539

osvdb.org/45540

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON

Related for CVE-2007-5146