Vulnerability CVE-2007-2660
Published: 2007-05-14   Modified: 2012-02-12

Description:
** DISPUTED ** PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199.

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Vincent blavet -> Phpconcept library 
Cjg explorer pro -> Cjg explorer pro 

 References:
http://xforce.iss.net/xforce/xfdb/34273
http://www.vupen.com/english/advisories/2007/1786
http://www.milw0rm.com/exploits/3915
http://www.attrition.org/pipermail/vim/2007-May/001618.html
http://secunia.com/advisories/25230
http://osvdb.org/36010
Copyright 2024, cxsecurity.com

 

Back to Top