CVE-2007-2660

** DISPUTED ** PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.attrition.org/pipermail/vim/2007-May/001618.html
http://secunia.com/advisories/25230	Vendor Advisory
http://osvdb.org/36010
http://www.vupen.com/english/advisories/2007/1786
https://exchange.xforce.ibmcloud.com/vulnerabilities/34273
https://www.exploit-db.com/exploits/3915

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cjg_explorer_pro:cjg_explorer_pro::::::::
	cpe:2.3:a:vincent_blavet:phpconcept_library::::::::

Information

Published : 2007-05-14 16:19

Updated : 2017-10-10 18:32

NVD link : CVE-2007-2660

Mitre link : CVE-2007-2660

JSON object : View

CWE

NVD-CWE-Other

Products Affected

vincent_blavet

phpconcept_library

cjg_explorer_pro

cjg_explorer_pro

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html", "name": "20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFI", "tags": [], "refsource": "VIM"}, {"url": "http://secunia.com/advisories/25230", "name": "25230", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/36010", "name": "36010", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/1786", "name": "ADV-2007-1786", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273", "name": "cjgexplorerpro-pcltarpcltrace-file-include(34273)", "tags": [], "refsource": "XF"}, {"url": "https://www.exploit-db.com/exploits/3915", "name": "3915", "tags": [], "refsource": "EXPLOIT-DB"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "** DISPUTED ** PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-2660", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-05-14T23:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cjg_explorer_pro:cjg_explorer_pro:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.3"}, {"cpe23Uri": "cpe:2.3:a:vincent_blavet:phpconcept_library:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-10-11T01:32Z"}

6.8 /10