CVE-2007-1766 PHP remote file inclusion vulnerability in login/engine/db/profiledit.php in Advanced Login 0.76 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
HighCVSS 10.0
EPSS 5.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file inclusion vulnerability in login/engine/db/profiledit.php in Advanced Login 0.76 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| msxstudios advanced login | <= 0.76 | No fix listed |
References
- 34587 vdb-entry
- 24695 third-party-advisory
- 2508 third-party-advisory
- 20070329 Advanced Login <= 0.7 (root) Remote File Inclusion Vulnerability mailing-list
- 23197 vdb-entry
- ADV-2007-1179 vdb-entry
- advanced-profiledit-file-include(33321) vdb-entry
- 3608 exploit