CVE-2007-2289 PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insert_link.php in download engine (Download-Engine) 1.4.1 allows remote authenticated users to execute arbitrary PHP code via a....
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insert_link.php in download engine (Download-Engine) 1.4.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the spaw_root parameter, a different vector than CVE-2007-2255. NOTE: this may be an issue in SPAW.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alexscriptengine download-engine | = 1.4.1 | No fix listed |
References
- 35401 vdb-entry
- 20070425 download engine V1.4.1 >> RFI (local) mailing-list
- downloadengine-insertlink-file-include(33918) vdb-entry