CVE-2007-5641
- State
- Published
- Severity
- Not scored
- Published
- Oct 23, 2007
- Updated
- Aug 7, 2024
- Reserved
- Oct 23, 2007
Description
Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3) events/index.php, (4) fax/index.php, (5) files/index.php, (6) files/list.php, (7) groupadm/index.php, (8) history/index.php, (9) info/index.php, (10) log/index.php, (11) mail/index.php, (12) messages/index.php, (13) organizations/index.php, (14) phones/index.php, (15) presence/index.php, (16) projects/index.php, (17) projects/summary.inc.php, (18) projects/list.php, (19) reports/index.php, (20) search/index.php, (21) snf/index.php, (22) syslog/index.php, (23) tasks/searchsimilar.php, (24) tasks/index.php, (25) tasks/summary.inc.php, and (26) useradm/index.php in modules; (27) /ajax/loadsplash.php; (28) /blocks/birthday.php; (29) /blocks/events.php; and (30) /blocks/help.php.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 41914vdb-entry
- 41907vdb-entry
- 4549exploit
- 41917vdb-entry
- 41910vdb-entry
- 41906vdb-entry
- 41957vdb-entry
- 41905vdb-entry
- 41920vdb-entry
- 41975vdb-entry
- 41908vdb-entry
- 41931vdb-entry
- 41918vdb-entry
- 41925vdb-entry
- phpprojectmanagement-fullpath-file-include(37347)vdb-entry
- 41934vdb-entry
- 41927vdb-entry
- 26150vdb-entry
- 41909vdb-entry
- 41928vdb-entry
- 41912vdb-entry
- 27347third-party-advisory
- 41913vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.