Lucene search

[email protected]CVE-2007-6652

HistoryJan 04, 2008 - 11:46 a.m.

CVE-2007-6652

2008-01-0411:46:00

CWE-94

[email protected]

web.nvd.nist.gov

code injection

security vulnerability

xcms

cve-2007-6652

remote code execution

8.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.046 Low

EPSS

Percentile

92.4%

JSON

cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php, which writes to dati/generali/footer.dtb (aka the XCMS footer).

CPENameOperatorVersion
xcms:xcmsxcmsle1.83

CPE	Name	Operator	Version
xcms:xcms	xcms	le	1.83

References

osvdb.org/40277

secunia.com/advisories/28256

exchange.xforce.ibmcloud.com/vulnerabilities/39346

www.exploit-db.com/exploits/4813

8.6 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.046 Low

EPSS

Percentile

92.4%

JSON

Related for CVE-2007-6652

prion1