CVE-2007-5307

{"id": "CVE-2007-5307", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-10-09T18:17:00.000", "references": [{"url": "http://securityreason.com/securityalert/3204", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/481683/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/25951", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37009", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3204", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/481683/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/25951", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37009", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a .php file via externe/swfupload/upload.php. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in ELSEIF CMS."}, {"lang": "es", "value": "ELSEIF CMS Beta 0.6 no elimina (unset) variables adecuadamente cuando los datos de entrada incluyen un par\u00e1metro num\u00e9rico con un valor que coincide con un valor de resumen (hash) de un par\u00e1metro alfanum\u00e9rico, lo cual permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n enviando un archivo .php mediante externe/swfupload/upload.php. NOTA: podr\u00eda discutirse que esta vulnerabilidad se debe a un fallo en el comando unset de PHP (CVE-2006-3017) y que la soluci\u00f3n adecuada deber\u00eda estar en PHP; en tal caso, esto no deber\u00eda ser tratado como una vulnerabilidad en ELSEIF CMS."}], "lastModified": "2024-11-21T00:37:37.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:yannick_tanguy:else_if_cms:0.6-beta:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEE8B4EB-C1A5-4993-9661-F1510813E478"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}