Vulnerability Details : CVE-2007-5641

Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3) events/index.php, (4) fax/index.php, (5) files/index.php, (6) files/list.php, (7) groupadm/index.php, (8) history/index.php, (9) info/index.php, (10) log/index.php, (11) mail/index.php, (12) messages/index.php, (13) organizations/index.php, (14) phones/index.php, (15) presence/index.php, (16) projects/index.php, (17) projects/summary.inc.php, (18) projects/list.php, (19) reports/index.php, (20) search/index.php, (21) snf/index.php, (22) syslog/index.php, (23) tasks/searchsimilar.php, (24) tasks/index.php, (25) tasks/summary.inc.php, and (26) useradm/index.php in modules; (27) /ajax/loadsplash.php; (28) /blocks/birthday.php; (29) /blocks/events.php; and (30) /blocks/help.php.
Publish Date : 2007-10-23 Last Update Date : 2017-09-29

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	6.8
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	Partial (Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.)
Availability Impact	Partial (There is reduced performance or interruptions in resource availability.)
Access Complexity	Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Execute CodeFile Inclusion
CWE ID	94

- Products Affected By CVE-2007-5641

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Phppm	Php Project Management	*	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Phppm	Php Project Management	1

- References For CVE-2007-5641

http://osvdb.org/41928
OSVDB 41928

http://secunia.com/advisories/27347
SECUNIA 27347

http://osvdb.org/41931
OSVDB 41931

http://osvdb.org/41905
OSVDB 41905

http://www.securityfocus.com/bid/26150
BID 26150 PHP Project Management Multiple Remote File Include Vulnerabilities Release Date:2007-10-24

http://osvdb.org/41912
OSVDB 41912

http://osvdb.org/41914
OSVDB 41914

http://osvdb.org/41910
OSVDB 41910

http://osvdb.org/41906
OSVDB 41906

http://osvdb.org/41927
OSVDB 41927

http://osvdb.org/41918
OSVDB 41918

http://osvdb.org/41909
OSVDB 41909

http://osvdb.org/41917
OSVDB 41917

http://osvdb.org/41907
OSVDB 41907

http://osvdb.org/41913
OSVDB 41913

http://osvdb.org/41908
OSVDB 41908

http://osvdb.org/41934
OSVDB 41934

http://osvdb.org/41920
OSVDB 41920

http://osvdb.org/41925
OSVDB 41925

http://osvdb.org/41957
OSVDB 41957

http://osvdb.org/41975
OSVDB 41975

https://exchange.xforce.ibmcloud.com/vulnerabilities/37347
XF phpprojectmanagement-fullpath-file-include(37347)

https://www.exploit-db.com/exploits/4549
EXPLOIT-DB 4549

- Metasploit Modules Related To CVE-2007-5641

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)