CVE-2005-0679 PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the script_root paramet...
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code. NOTE: it was later reported that 2.4 is also affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stadtaus tell a friend script | <= 2.7 | No fix listed |
References
- arfis.wordpress.com
- 1013390 patch vdb-entry
- 14628 vdb-entry
- 20070727 Friend Script 2.5 - 2.4 Remote File İnclude mailing-list
- www.stadtaus.com
- www.stadtaus.com patch vendor-advisory
- tellafriend-scriptroot-file-include(19630) vdb-entry