CVE-2007-2660

{"id": "CVE-2007-2660", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-05-14T23:19:00.000", "references": [{"url": "http://osvdb.org/36010", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/25230", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/1786", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/3915", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199"}, {"lang": "es", "value": "** IMPUGNADO ** Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en pcltrace.lib.php en el m\u00f3dulo PclTar en Vincent Blavet PhpConcept Library, seg\u00fan utilizado en CJG EXPLORER PRO 3.3 y anteriores y posiblemente otros productos, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s de una URL en el par\u00e1metro g_pcltar_lib_dir. NOTA: CVE impugna este asunto puesto que no hay ninguna declaraci\u00f3n en pcltrace.lib.ph. NOTA: el vector pcltar.lib.php est\u00e1 actualmente cubierto por CVE-2007-2199."}], "lastModified": "2024-04-11T00:42:14.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cjg_explorer_pro:cjg_explorer_pro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6940066-C9C1-4407-B923-E8F89AC26711", "versionEndIncluding": "3.3"}, {"criteria": "cpe:2.3:a:vincent_blavet:phpconcept_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "947C7344-2725-46E4-891F-4A2B0510764C"}], "operator": "OR"}]}], "evaluatorImpact": "Successful exploitation requires that \"register_globals\" is enabled.\r\n", "sourceIdentifier": "cve@mitre.org"}