Multiple PHP remote file inclusion vulnerabilities in Guestbook Script 1.9 allow remote attackers to execute arbitrary PHP code via a URL in the script_root parameter to (1) delete.php, (2) edit.php, or (3) inc/common.inc.php; or (4) database.php, (5) entries.php, (6) index.php, (7) logout.php, or (8) settings.php in admin/. NOTE: a third party disputes this vulnerability, noting that these scripts defend against direct requests
References
Configurations
History
07 Nov 2023, 02:01
Type | Values Removed | Values Added |
---|---|---|
Summary | Multiple PHP remote file inclusion vulnerabilities in Guestbook Script 1.9 allow remote attackers to execute arbitrary PHP code via a URL in the script_root parameter to (1) delete.php, (2) edit.php, or (3) inc/common.inc.php; or (4) database.php, (5) entries.php, (6) index.php, (7) logout.php, or (8) settings.php in admin/. NOTE: a third party disputes this vulnerability, noting that these scripts defend against direct requests |
Information
Published : 2007-08-09 21:17
Updated : 2024-08-07 15:15
NVD link : CVE-2007-4290
Mitre link : CVE-2007-4290
CVE.ORG link : CVE-2007-4290
JSON object : View
Products Affected
stadtaus
- guestbook_script
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')