CVE-2007-3057 PHP remote file inclusion vulnerability in include/wysiwyg/spaw_control.class.php in the icontent 4.5 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root....
MediumCVSS 6.8
EPSS 68.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file inclusion vulnerability in include/wysiwyg/spaw_control.class.php in the icontent 4.5 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: this issue is probably a duplicate of CVE-2006-4656.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xoops icontent module | = 4.5 | No fix listed |
References
- 20070602 [VIM] True: XOOPS Module icontent v.1.0 Remote File Inclusion Exploit (Milw0rm 4022) mailing-list
- 35381 vdb-entry
- 25522 third-party-advisory vendor-advisory
- 24302 vdb-entry
- ADV-2007-2047 vdb-entry
- xoops-icontent-spawcontrolclass-file-include(34681) vdb-entry
- 4022 exploit