7.5

CVE-2007-4738

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) db_conf or (2) ADODB_DIR parameter to utils/stphpimage_show.php; or a URL in the STPHPLIB_DIR parameter to (3) stphpbutton.php, (4) stphpcheckbox.php, (5) stphpcheckboxwithcaption.php, (6) stphpcheckgroup.php, (7) stphpcomponent.php, (8) stphpcontrolwithcaption.php, (9) stphpedit.php, (10) stphpeditwithcaption.php, (11) stphphr.php, (12) stphpimage.php, (13) stphpimagewithcaption.php, (14) stphplabel.php, (15) stphplistbox.php, (16) stphplistboxwithcaption.php, (17) stphplocale.php, (18) stphppanel.php, (19) stphpradiobutton.php, (20) stphpradiobuttonwithcaption.php, (21) stphpradiogroup.php, (22) stphprichbutton.php, (23) stphpspacer.php, (24) stphptable.php, (25) stphptablecell.php, (26) stphptablerow.php, (27) stphptabpanel.php, (28) stphptabtitle.php, (29) stphptextarea.php, (30) stphptextareawithcaption.php, (31) stphptoolbar.php, (32) stphpwindow.php, (33) stphpxmldoc.php, or (34) stphpxmlelement.php, a different set of vectors than CVE-2007-4737.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Speedtech ≫ Stphplibrary Version0.8.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.66% 0.952
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://secunia.com/advisories/26658
Vendor Advisory
http://www.securityfocus.com/bid/25525
http://osvdb.org/39073
http://osvdb.org/39074
http://osvdb.org/39075
http://osvdb.org/39076
http://osvdb.org/39077
http://osvdb.org/39078
http://osvdb.org/39079
http://osvdb.org/39080
http://osvdb.org/39081
http://osvdb.org/39082
http://osvdb.org/39083
http://osvdb.org/39084
http://osvdb.org/39085
http://osvdb.org/39086
http://osvdb.org/39087
http://osvdb.org/39088
http://osvdb.org/39089
http://osvdb.org/39090
http://osvdb.org/39091
http://osvdb.org/39092
http://osvdb.org/39093
http://osvdb.org/39094
http://osvdb.org/39095
http://osvdb.org/39096
http://osvdb.org/39097
http://osvdb.org/39098
http://osvdb.org/39099
http://osvdb.org/39100
http://osvdb.org/39101
http://osvdb.org/39102
http://osvdb.org/39103
http://osvdb.org/39104
http://osvdb.org/39105
https://exchange.xforce.ibmcloud.com/vulnerabilities/36417