CVE-2007-1635 Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in....
HighCVSS 9.0
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a "ConfigSave" op to admin.php, which can later be accessed via a "Configure" op to admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| net portal dynamic system | <= 5.10 | No fix listed |
References
- 34303 vdb-entry
- 24571 third-party-advisory vendor-advisory
- 2473 third-party-advisory
- 20070318 Net Portal Dynamic System (NPDS) <= 5.10 Remote Code Execution 0day mailing-list