CVE-2007-5117 Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root pa...
HighCVSS 9.3
EPSS 3.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/login.php and (2) includes/lang/language.php, different vectors than CVE-2007-4279.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| frontaccounting | = 1.13 | No fix listed |
References
- arfis.wordpress.com
- 26962 third-party-advisory vendor-advisory
- 25812 exploit vdb-entry
- frontaccounting-pathtoroot-file-include(36796) vdb-entry
- 4456 exploit