CVE-2007-4886 Code injection in n/a
Remote attackers can execute arbitrary PHP code in AuraCMS via incomplete blacklist filtering in the pilih parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-4886?
CVE-2007-4886 is a medium-severity code injection vulnerability in n/a, published on 14 Sep 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs.
Weakness: CWE-94
Which versions are affected by CVE-2007-4886?
It affects 1 product.
Products include Auracms Auracms.
How do I fix CVE-2007-4886?
No fix has been published for CVE-2007-4886 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2007-4886 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-4886 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-phcg-r9vc-9257.