CVE

Id
23727  
CVE No.
CVE-2007-0370  
Status
Candidate  
Description
Unrestricted file upload vulnerability in index.php in phpBP RC3 (2.204) and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an image_form parameter specifying a multiple-extension filename such as .jpg.vil.gif.php, which is stored in upload/banners/ under a different name, and executable via a direct request. NOTE: a separate SQL injection issue could be leveraged to make this vulnerability reachable by remote unauthenticated attackers.  
Phase
Assigned (20070119)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
230495 23727 CVE-2007-0370 MILW0RM:3153  View
230496 23727 CVE-2007-0370 URL:http://milw0rm.com/exploits/3153  View
230497 23727 CVE-2007-0370 OSVDB:34762  View
230498 23727 CVE-2007-0370 URL:http://osvdb.org/34762  View
230499 23727 CVE-2007-0370 XF:phpbp-banner-file-upload(31619)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
52719 JVNDB-2007-001411 Francisco Burzi PHP-Nuke における SQL インジェクションの脆弱性 Francisco Burzi PHP-Nuke には、SQL インジェクションの脆弱性が存在します。 CVE-2007-0372 23727 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001411.html  View