CVE

Id
27893  
CVE No.
CVE-2007-4536  
Status
Candidate  
Description
TorrentTrader 1.07 and earlier sets insecure permissions for files in the root directory, which allows attackers to execute arbitrary PHP code by modifying (1) disclaimer.txt, (2) sponsors.txt, and (3) banners.txt, which are used in an include call. NOTE: there might be local attack vectors that extend to other files.  
Phase
Assigned (20070824)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
287719 27893 CVE-2007-4536 CONFIRM:http://www.torrenttrader.org/index.php?showtopic=5843  View
287720 27893 CVE-2007-4536 VIM:20070824 uh-oh: local file inclusion from insecure permissions  View
287721 27893 CVE-2007-4536 URL:http://www.attrition.org/pipermail/vim/2007-August/001774.html  View
287722 27893 CVE-2007-4536 BID:25536  View
287723 27893 CVE-2007-4536 URL:http://www.securityfocus.com/bid/25536  View
287724 27893 CVE-2007-4536 OSVDB:40257  View
287725 27893 CVE-2007-4536 URL:http://osvdb.org/40257  View
287726 27893 CVE-2007-4536 SECUNIA:26679  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
55638 JVNDB-2007-004330 Bugzilla の email_in.pl における任意のコマンドを実行される脆弱性 Bugzilla の email_in.pl は、任意のコマンドを実行される脆弱性が存在します。 CVE-2007-4538 27893 5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-004330.html  View