CVE-2007-1976

PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application's checkSuperglobals function defends against the attack

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.97% chance of exploitation in the next 30 days, 79th percentile

Published

2007-04-12

Updated

2024-08-07

Proof-of-concept exploits (3)

• https://www.exploit-db.com/exploits/3642
• http://www.attrition.org/pipermail/vim/2007-April/001490.html
• http://www.attrition.org/pipermail/vim/2007-April/001489.html

References

• CVE Record
• NVD entry

Related

• CVE-2007-1974
• CVE-2007-1978
• CVE-2007-1971
• CVE-2007-1979
• CVE-2007-1968
• CVE-2007-1980