CVE

Id
26342  
CVE No.
CVE-2007-2985  
Status
Candidate  
Description
Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the administrator"s username, which can be used to (1) obtain sensitive information, including the administrator password, via settings.php or (2) upload and execute arbitrary PHP code via an update_doc action in edit.php.  
Phase
Assigned (20070531)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
266769 26342 CVE-2007-2985 MILW0RM:4006  View
266770 26342 CVE-2007-2985 URL:http://www.milw0rm.com/exploits/4006  View
266771 26342 CVE-2007-2985 OSVDB:36737  View
266772 26342 CVE-2007-2985 URL:http://osvdb.org/36737  View
266773 26342 CVE-2007-2985 SECUNIA:25460  View
266774 26342 CVE-2007-2985 URL:http://secunia.com/advisories/25460  View
266775 26342 CVE-2007-2985 XF:pheap-edit-code-execution(34592)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
56943 JVNDB-2007-005635 Zenturi ProgramChecker の sasatl.dll におけるバッファオーバーフローの脆弱性 Zenturi ProgramChecker の sasatl.dll の特定の ActiveX コントロールには、バッファオーバーフローの脆弱性が存在します。 CVE-2007-2987 26342 9.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-005635.html  View