CVE-2007-5914
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing…
Does this matter?
Lower severity and a low EPSS score (5.43%). Track it; it rarely justifies an emergency change on its own.
Description
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by unauthenticated remote attackers by leveraging CVE-2007-5913.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 5.43% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- jean charles/jbc explorer
- Source
- cve@mitre.org
References
- http://mgsdl.free.fr/?1:33
- http://osvdb.org/42070
- http://secunia.com/advisories/27533Vendor Advisory
- http://securityreason.com/securityalert/3358
- http://www.securityfocus.com/archive/1/483268/100/0/threaded
- https://www.exploit-db.com/exploits/4608
- http://mgsdl.free.fr/?1:33
- http://osvdb.org/42070
- http://secunia.com/advisories/27533Vendor Advisory
- http://securityreason.com/securityalert/3358
- http://www.securityfocus.com/archive/1/483268/100/0/threaded
- https://www.exploit-db.com/exploits/4608
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.