CVE-2007-1620
Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SITE_PATH] parameter to (a) wind/help.php or (b) wind/about.php, or the (2)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.0%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SITE_PATH] parameter to (a) wind/help.php or (b) wind/about.php, or the (2) _SESSION[DRIVER] parameter to (c) db/session.php.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 11.02% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- php db designer/php db designer
- Source
- cve@mitre.org
References
- http://osvdb.org/37210
- http://osvdb.org/37211
- http://osvdb.org/37212
- http://www.vupen.com/english/advisories/2007/1007
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33033
- https://www.exploit-db.com/exploits/3501
- http://osvdb.org/37210
- http://osvdb.org/37211
- http://osvdb.org/37212
- http://www.vupen.com/english/advisories/2007/1007
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33033
- https://www.exploit-db.com/exploits/3501
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.