CVE-2007-5641
Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 40.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3) events/index.php, (4) fax/index.php, (5) files/index.php, (6) files/list.php, (7) groupadm/index.php, (8) history/index.php, (9) info/index.php, (10) log/index.php, (11) mail/index.php, (12) messages/index.php, (13) organizations/index.php, (14) phones/index.php, (15) presence/index.php, (16) projects/index.php, (17) projects/summary.inc.php, (18) projects/list.php, (19) reports/index.php, (20) search/index.php, (21) snf/index.php, (22) syslog/index.php, (23) tasks/searchsimilar.php, (24) tasks/index.php, (25) tasks/summary.inc.php, and (26) useradm/index.php in modules; (27) /ajax/loadsplash.php; (28) /blocks/birthday.php; (29) /blocks/events.php; and (30) /blocks/help.php.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 40.26% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- phppm/php project management
- Source
- cve@mitre.org
References
- http://osvdb.org/41905
- http://osvdb.org/41906
- http://osvdb.org/41907
- http://osvdb.org/41908
- http://osvdb.org/41909
- http://osvdb.org/41910
- http://osvdb.org/41912
- http://osvdb.org/41913
- http://osvdb.org/41914
- http://osvdb.org/41917
- http://osvdb.org/41918
- http://osvdb.org/41920
- http://osvdb.org/41925
- http://osvdb.org/41927
- http://osvdb.org/41928
- http://osvdb.org/41931
- http://osvdb.org/41934
- http://osvdb.org/41957
- http://osvdb.org/41975
- http://secunia.com/advisories/27347Vendor Advisory
- http://www.securityfocus.com/bid/26150
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37347
- https://www.exploit-db.com/exploits/4549
- http://osvdb.org/41905
- http://osvdb.org/41906
- http://osvdb.org/41907
- http://osvdb.org/41908
- http://osvdb.org/41909
- http://osvdb.org/41910
- http://osvdb.org/41912
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.