VulnerabilityModified

CVE-2007-5071

HIGH 7.5EPSS 3.02%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Incomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability was also present in a 0.5.1 download available in the early morning of 20070923. NOTE: the original 20070920 disclosure provided an incorrect filename, img_upload_cgi.php.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 3.02% probability · 87th percentile
CISA KEV: Not listed
Weakness: CWE-16
Affected: alexander palmo/simple php blog
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.