CVE-2007-1987

Multiple PHP remote file inclusion vulnerabilities in PHPEcho CMS 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) _plugin_file parameter to smarty/internals/core.load_pulgins.php or the (2) root_path parameter to index.php. NOTE: CVE disputes (1) because the inclusion occurs within a function that is not called during a direct request. CVE disputes (2) because root_path is defined in config.php before use

🔗 References (6)

• cve@mitrehttp://osvdb.org/34117
• cve@mitrehttp://securityreason.com/securityalert/2551
• cve@mitrehttp://www.securityfocus.com/archive/1/464709/100/0/threaded
• af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/34117
• af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/2551
• af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/464709/100/0/threaded