CVE

Id
25333  
CVE No.
CVE-2007-1976  
Status
Candidate  
Description
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application"s checkSuperglobals function defends against the attack.  
Phase
Assigned (20070411)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
252614 25333 CVE-2007-1976 MILW0RM:3642  View
252615 25333 CVE-2007-1976 URL:http://www.milw0rm.com/exploits/3642  View
252616 25333 CVE-2007-1976 VIM:20070403 Bogus - [Xoops Module Virii Info <= 1.10 (index.php) Remote File Include Exploit]  View
252617 25333 CVE-2007-1976 URL:http://www.attrition.org/pipermail/vim/2007-April/001489.html  View
252618 25333 CVE-2007-1976 VIM:20070403 Bogus - [Xoops Module Virii Info <= 1.10 (index.php) Remote File Include Exploit]  View
252619 25333 CVE-2007-1976 URL:http://www.attrition.org/pipermail/vim/2007-April/001490.html  View
252620 25333 CVE-2007-1976 VUPEN:ADV-2007-1206  View
252621 25333 CVE-2007-1976 URL:http://www.vupen.com/english/advisories/2007/1206  View
252622 25333 CVE-2007-1976 OSVDB:37429  View
252623 25333 CVE-2007-1976 URL:http://osvdb.org/37429  View
252624 25333 CVE-2007-1976 XF:xoops-virii-index-file-include(33368)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
54983 JVNDB-2007-003675 PHP-Fusion 用の Arcade モジュールにおける SQL インジェクションの脆弱性 PHP-Fusion 用の Arcade モジュールの index.php には、SQL インジェクションの脆弱性が存在します。 CVE-2007-1978 25333 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-003675.html  View