CVE-2007-2255

CVE-2007-2255 affects Download-Engine 1.4.3 and describes multiple PHP remote file inclusion vulnerabilities. The vulnerabilities allow an attacker to supply a URL in parameters (eng_dir to addmember.php, lang_path to admin/enginelib/class.phpmailer.php, and spaw_root to admin/includes/spaw/dialo...

CVE-2007-2289

CVE-2007-2289 describes a PHP remote file inclusion in Download-Engine.1.4.1, via the spaw_root parameter in admin/includes/spaw/dialogs/insert_link.php, allowing remote authenticated users to execute arbitrary PHP code. This is a different vector than CVE-2007-2255. No remediation or fix details...