CVE-2007-4328 Multiple PHP remote file inclusion vulnerabilities in Mapos Bilder Galerie 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2)...
MediumCVSS 6.8
EPSS 6.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple PHP remote file inclusion vulnerabilities in Mapos Bilder Galerie 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2) galerie.php, or (3) anzagien.php. NOTE: A later report states that 1.1 is also affected, but that the filename for vector 3 is anzeigen.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mapos scripts bilder galerie | = 1.0 | No fix listed |
| mapos scripts bilder galerie | = 1.1 | No fix listed |
References
- 36455 vdb-entry
- 36456 vdb-entry
- 36457 vdb-entry
- 26400 third-party-advisory vendor-advisory
- 2999 third-party-advisory
- 20070809 Mapos Bilder Galerie Version 1.0 Remote Command Execution Vulnerability mailing-list
- 25256 exploit vdb-entry
- ADV-2007-2838 vdb-entry vendor-advisory
- bildergalerie-multiple-file-include(35923) vdb-entry