7.5

CVE-2007-2260

Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the bibtexrootrel parameter to (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7) importinfo.php, (8) import.php, (9) examplefile.php, (10) clearinfo.php, (11) clear.php, (12) aboutinfo.php, (13) about.php, and other unspecified files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bibtex ≫ Mase Version2.0_beta
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.47% 0.824
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://osvdb.org/35621
http://osvdb.org/35622
http://osvdb.org/35623
http://osvdb.org/35624
http://osvdb.org/35625
http://osvdb.org/35626
http://osvdb.org/35627
http://osvdb.org/35628
http://osvdb.org/35629
http://osvdb.org/35630
http://osvdb.org/35631
http://osvdb.org/35632
http://osvdb.org/35633
http://securityreason.com/securityalert/2624
http://www.securityfocus.com/archive/1/466683/100/0/threaded