CVE-2007-2777
Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary .php filename in the zip parameter, which is created under…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary .php filename in the zip parameter, which is created under sptemplates/.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 6.32% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- alstrasoft/template seller
- Source
- cve@mitre.org
References
- http://osvdb.org/40423
- http://www.securityfocus.com/bid/24068
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34398
- https://www.exploit-db.com/exploits/3959
- http://osvdb.org/40423
- http://www.securityfocus.com/bid/24068
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34398
- https://www.exploit-db.com/exploits/3959
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.