CVE-2007-5186 PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir...
MediumCVSS 6.8
EPSS 46.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| segue cms | <= 1.8.4 | No fix listed |
References
- 27025 third-party-advisory vendor-advisory
- sourceforge.net
- 20071001 Bogus: Segue CMS <= 1.8.4 index.php Remote File Inclusion Vulnerability mailing-list
- 20071001 Bogus: Segue CMS <= 1.8.4 index.php Remote File Inclusion Vulnerability mailing-list
- 25889 vdb-entry
- ADV-2007-3342 vdb-entry vendor-advisory
- segue-index-file-include(36903) vdb-entry
- 4476 exploit