Lucene search

MitreCVE-2007-0639

HistoryJan 31, 2007 - 9:28 p.m.

CVE-2007-0639

2007-01-3121:28:00

mitre

web.nvd.nist.gov

cve-2007-0639

static code injection

guppy

remote attackers

php

.inc file

data directory

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.018

Percentile

88.2%

JSON

Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject arbitrary PHP code into a .inc file in the data/ directory via (1) a REMOTE_ADDR cookie or (2) a cookie specifying an element of the msg array with an error number in the first dimension and 0 in the second dimension, as demonstrated by msg[999][0].

Affected configurations

Nvd

Node

guppyguppyRange≤4.5.16

VendorProductVersionCPE
guppyguppy*cpe:2.3:a:guppy:guppy:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
guppy	guppy	*	cpe:2.3:a:guppy:guppy::::::::

References

osvdb.org/33016

retrogod.altervista.org/guppy_4516_cmd.html

secunia.com/advisories/23914

securitytracker.com/id?1017569

www.vupen.com/english/advisories/2007/0421

exchange.xforce.ibmcloud.com/vulnerabilities/31882

www.exploit-db.com/exploits/3221

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.018

Percentile

88.2%

JSON

Related for CVE-2007-0639