CVE-2007-2431

Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web script via the _SERVER[SCRIPT_NAME] parameter.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

5.10% chance of exploitation in the next 30 days, 92th percentile

Published

2007-05-02

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/3816

References

• CVE Record
• NVD entry

Related

• CVE-2007-2430
• CVE-2007-2434
• CVE-2007-2429
• CVE-2007-2437
• CVE-2007-2428
• CVE-2007-2440