CVE-2007-4169 Code injection in n/a
Remote attackers can execute arbitrary PHP code in vgallite via remote file inclusion, though the vulnerability's validity is disputed by the assigner.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-4169?
CVE-2007-4169 is a high-severity code injection vulnerability in n/a, published on 7 Aug 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple PHP remote file inclusion vulnerabilities in vgallite allow remote attackers to execute arbitrary PHP code via a URL in the (1) dirpath parameter to _functions.php or the (2) lang parameter to index.php. NOTE: CVE disputes vector 1 because the applicable include_once is located in a function that is not called on a direct request, and because $dirpath is an argument to this function. CVE disputes vector 2 because "lang" is a constant string within an include_once, not a variable. The researcher is also unreliable
Weakness: CWE-94
Which versions are affected by CVE-2007-4169?
It affects 1 product.
Products include Vgallite Vgallite.
How do I fix CVE-2007-4169?
No fix has been published for CVE-2007-4169 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2007-4169 being exploited?
There is no known exploitation of CVE-2007-4169 in the wild and no public exploit code.
Sources
Also known as GHSA-7w39-38pw-xgpf.