CVE-2007-2988 A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary....
HighCVSS 7.5
EPSS 7.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/create_engine.php followed by a request to admin/generate_tabs.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inout scripts inout meta search engine | All versions | No fix listed |
References
- 42034 vdb-entry
- 2763 third-party-advisory
- 20070528 Inout Meta Searh engine Remote Code Execution mailing-list
- 24189 vdb-entry
- 24199 vdb-entry
- inout-searchengine-create-code-execution(34563) vdb-entry
- 4004 exploit