VulnerabilityModified
CVE-2007-6471
Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ (dot dot backslash) in the config parameter.
MEDIUM 5.8EPSS 2.30%
Does this matter?
Lower severity and a low EPSS score (2.30%). Track it; it rarely justifies an emergency change on its own.
Description
Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ (dot dot backslash) in the config parameter.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 2.30% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- phpay/phpay
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/28111Vendor Advisory
- http://securityreason.com/securityalert/3466
- http://www.securityfocus.com/archive/1/485149/100/0/threaded
- http://www.securityfocus.com/bid/26881Exploit
- http://www.vupen.com/english/advisories/2007/4231
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39063
- http://secunia.com/advisories/28111Vendor Advisory
- http://securityreason.com/securityalert/3466
- http://www.securityfocus.com/archive/1/485149/100/0/threaded
- http://www.securityfocus.com/bid/26881Exploit
- http://www.vupen.com/english/advisories/2007/4231
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39063
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.