CVE-2007-5015 Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to execute arbitrary PHP code via a URL in the sl_theme_unix_path parameter to (1) ad...
MediumCVSS 6.8
EPSS 38.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple PHP remote file inclusion vulnerabilities in Streamline PHP Media Server 1.0-beta4 allow remote attackers to execute arbitrary PHP code via a URL in the sl_theme_unix_path parameter to (1) admin_footer.php, (2) info_footer.php, (3) theme_footer.php, (4) browse_footer.php, (5) account_footer.php, or (6) search_footer.php in core/theme/includes/. NOTE: the vulnerability is present only when the administrator does not follow installation instructions about the requirement for .htaccess Limit support.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| streamline | = 1.0_beta4 | No fix listed |
References
- arfis.wordpress.com exploit
- 38290 vdb-entry
- 38291 vdb-entry
- 38292 vdb-entry
- 38293 vdb-entry
- 38294 vdb-entry
- 38295 vdb-entry
- 25736 exploit vdb-entry
- streamline-accountfooter-file-include(36683) vdb-entry
- 4430 exploit