CVE

Id
25612  
CVE No.
CVE-2007-2255  
Status
Candidate  
Description
Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) eng_dir parameter to addmember.php, (2) lang_path parameter to admin/enginelib/class.phpmailer.php, and the (3) spaw_root parameter to admin/includes/spaw/dialogs/colorpicker.php, different vectors than CVE-2006-5291 and CVE-2006-5459. NOTE: vector 3 might be an issue in SPAW.  
Phase
Assigned (20070425)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
256015 25612 CVE-2007-2255 BUGTRAQ:20070417 Remot File Include download_engine_V1.4.3  View
256016 25612 CVE-2007-2255 URL:http://www.securityfocus.com/archive/1/archive/1/465984/100/100/threaded  View
256017 25612 CVE-2007-2255 OSVDB:35398  View
256018 25612 CVE-2007-2255 URL:http://osvdb.org/35398  View
256019 25612 CVE-2007-2255 OSVDB:35399  View
256020 25612 CVE-2007-2255 URL:http://osvdb.org/35399  View
256021 25612 CVE-2007-2255 OSVDB:35400  View
256022 25612 CVE-2007-2255 URL:http://osvdb.org/35400  View
256023 25612 CVE-2007-2255 SREASON:2619  View
256024 25612 CVE-2007-2255 URL:http://securityreason.com/securityalert/2619  View
256025 25612 CVE-2007-2255 XF:downloadengine-multiple-file-include(33723)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
53197 JVNDB-2007-001889 Fully Modded phpBB2 の subscp.php における PHP リモートファイルインクルージョンの脆弱性 Fully Modded phpBB2 の subscp.php には、PHP リモートファイルインクルージョンの脆弱性が存在します。 CVE-2007-2257 25612 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001889.html  View