CVE-2007-2660 (GCVE-0-2007-2660)

Vulnerability from cvelistv5 – Published: 2007-05-14 23:00 – Updated: 2024-08-07 13:49 Disputed
VLAI?
Summary
PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/25230 third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2007/1786 vdb-entryx_refsource_VUPEN
http://www.attrition.org/pipermail/vim/2007-May/0… mailing-listx_refsource_VIM
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/3915 exploitx_refsource_EXPLOIT-DB
http://osvdb.org/36010 vdb-entryx_refsource_OSVDB
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:49:57.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "25230",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25230"
          },
          {
            "name": "ADV-2007-1786",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/1786"
          },
          {
            "name": "20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFI",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
          },
          {
            "name": "cjgexplorerpro-pcltarpcltrace-file-include(34273)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
          },
          {
            "name": "3915",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/3915"
          },
          {
            "name": "36010",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36010"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "25230",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25230"
        },
        {
          "name": "ADV-2007-1786",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/1786"
        },
        {
          "name": "20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFI",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
        },
        {
          "name": "cjgexplorerpro-pcltarpcltrace-file-include(34273)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
        },
        {
          "name": "3915",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/3915"
        },
        {
          "name": "36010",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36010"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2660",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED **  PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "25230",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25230"
            },
            {
              "name": "ADV-2007-1786",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/1786"
            },
            {
              "name": "20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFI",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
            },
            {
              "name": "cjgexplorerpro-pcltarpcltrace-file-include(34273)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
            },
            {
              "name": "3915",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/3915"
            },
            {
              "name": "36010",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/36010"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2660",
    "datePublished": "2007-05-14T23:00:00",
    "dateReserved": "2007-05-14T00:00:00",
    "dateUpdated": "2024-08-07T13:49:57.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cjg_explorer_pro:cjg_explorer_pro:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.3\", \"matchCriteriaId\": \"C6940066-C9C1-4407-B923-E8F89AC26711\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:vincent_blavet:phpconcept_library:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"947C7344-2725-46E4-891F-4A2B0510764C\"}]}]}]",
      "cveTags": "[{\"sourceIdentifier\": \"cve@mitre.org\", \"tags\": [\"disputed\"]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199\"}, {\"lang\": \"es\", \"value\": \"** IMPUGNADO ** Vulnerabilidad de inclusi\\u00f3n remota de archivo en PHP en pcltrace.lib.php en el m\\u00f3dulo PclTar en Vincent Blavet PhpConcept Library, seg\\u00fan utilizado en CJG EXPLORER PRO 3.3 y anteriores y posiblemente otros productos, permite a atacantes remotos ejecutar c\\u00f3digo PHP de su elecci\\u00f3n a trav\\u00e9s de una URL en el par\\u00e1metro g_pcltar_lib_dir. NOTA: CVE impugna este asunto puesto que no hay ninguna declaraci\\u00f3n en pcltrace.lib.ph. NOTA: el vector pcltar.lib.php est\\u00e1 actualmente cubierto por CVE-2007-2199.\"}]",
      "evaluatorImpact": "Successful exploitation requires that \"register_globals\" is enabled.\r\n",
      "id": "CVE-2007-2660",
      "lastModified": "2024-11-21T00:31:20.783",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": true, \"userInteractionRequired\": false}]}",
      "published": "2007-05-14T23:19:00.000",
      "references": "[{\"url\": \"http://osvdb.org/36010\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/25230\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.attrition.org/pipermail/vim/2007-May/001618.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2007/1786\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/34273\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.exploit-db.com/exploits/3915\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://osvdb.org/36010\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/25230\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.attrition.org/pipermail/vim/2007-May/001618.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2007/1786\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/34273\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.exploit-db.com/exploits/3915\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2007-2660\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2007-05-14T23:19:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[{\"sourceIdentifier\":\"cve@mitre.org\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199\"},{\"lang\":\"es\",\"value\":\"** IMPUGNADO ** Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en pcltrace.lib.php en el m\u00f3dulo PclTar en Vincent Blavet PhpConcept Library, seg\u00fan utilizado en CJG EXPLORER PRO 3.3 y anteriores y posiblemente otros productos, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s de una URL en el par\u00e1metro g_pcltar_lib_dir. NOTA: CVE impugna este asunto puesto que no hay ninguna declaraci\u00f3n en pcltrace.lib.ph. NOTA: el vector pcltar.lib.php est\u00e1 actualmente cubierto por CVE-2007-2199.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cjg_explorer_pro:cjg_explorer_pro:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.3\",\"matchCriteriaId\":\"C6940066-C9C1-4407-B923-E8F89AC26711\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vincent_blavet:phpconcept_library:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"947C7344-2725-46E4-891F-4A2B0510764C\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/36010\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/25230\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.attrition.org/pipermail/vim/2007-May/001618.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/1786\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/34273\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.exploit-db.com/exploits/3915\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/36010\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/25230\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.attrition.org/pipermail/vim/2007-May/001618.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/1786\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/34273\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.exploit-db.com/exploits/3915\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorImpact\":\"Successful exploitation requires that \\\"register_globals\\\" is enabled.\\r\\n\"}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.