CVE-2007-5071 File upload in n/a

High 7.5 Published 24 Sep 2007 Updated 7 Aug 2024

Remote attackers can upload malicious files to Simple PHP Blog to execute arbitrary code due to an incomplete blacklist.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-5071?

CVE-2007-5071 is a high-severity vulnerability in n/a, published on 24 Sep 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrated by a filename ending in .php. or a .htaccess file, a different vector than CVE-2005-2733. NOTE: the vulnerability was also present in a 0.5.1 download available in the early morning of 20070923. NOTE: the original 20070920 disclosure provided an incorrect filename, img_upload_cgi.php.

Weakness: CWE-16

Which versions are affected by CVE-2007-5071?

It affects 1 product.

Products include Alexander Palmo Simple Php Blog.

How do I fix CVE-2007-5071?

No fix has been published for CVE-2007-5071 yet. Limit exposure of the affected software until one is available.

Is CVE-2007-5071 being exploited?

There is no known exploitation of CVE-2007-5071 in the wild and no public exploit code.

Sources

Also known as GHSA-f84q-7gqj-p267.