VulnerabilityModified
CVE-2007-2167
Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter in an update action.
HIGH 7.5EPSS 44.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 44.4%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter in an update action.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 44.43% probability · 99th percentile
- CISA KEV
- Not listed
- Affected
- aimstats/aimstats
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/24955
- http://www.securityfocus.com/bid/23573
- http://www.vupen.com/english/advisories/2007/1447
- http://www.x-pose.org/aimstats.php
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33742
- https://www.exploit-db.com/exploits/3762
- http://secunia.com/advisories/24955
- http://www.securityfocus.com/bid/23573
- http://www.vupen.com/english/advisories/2007/1447
- http://www.x-pose.org/aimstats.php
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33742
- https://www.exploit-db.com/exploits/3762
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.