CVE-2007-5772

Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1. NOTE: unauthenticated remote attackers can exploit this by leveraging a cookie manipulation issue.

CVSS v2.0

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

3.83% chance of exploitation in the next 30 days, 89th percentile

Published

2007-11-01

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/4562

References

• CVE Record
• NVD entry

Related

• CVE-2007-5771
• CVE-2007-5773
• CVE-2007-5762
• CVE-2007-5774
• CVE-2007-5755
• CVE-2007-5775