FKIE_CVE-2007-2660

Vulnerability from fkie_nvd - Published: 2007-05-14 23:19 - Updated: 2025-04-09 00:30
Severity ?
Summary
PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199
References
cve@mitre.orghttp://osvdb.org/36010
cve@mitre.orghttp://secunia.com/advisories/25230Vendor Advisory
cve@mitre.orghttp://www.attrition.org/pipermail/vim/2007-May/001618.html
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/1786
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34273
cve@mitre.orghttps://www.exploit-db.com/exploits/3915
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36010
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25230Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.attrition.org/pipermail/vim/2007-May/001618.html
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/1786
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34273
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/3915
Impacted products
Vendor Product Version
cjg_explorer_pro cjg_explorer_pro *
vincent_blavet phpconcept_library *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cjg_explorer_pro:cjg_explorer_pro:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6940066-C9C1-4407-B923-E8F89AC26711",
              "versionEndIncluding": "3.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vincent_blavet:phpconcept_library:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "947C7344-2725-46E4-891F-4A2B0510764C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199"
    },
    {
      "lang": "es",
      "value": "** IMPUGNADO ** Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en pcltrace.lib.php en el m\u00f3dulo PclTar en Vincent Blavet PhpConcept Library, seg\u00fan utilizado en CJG EXPLORER PRO 3.3 y anteriores y posiblemente otros productos, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s de una URL en el par\u00e1metro g_pcltar_lib_dir. NOTA: CVE impugna este asunto puesto que no hay ninguna declaraci\u00f3n en pcltrace.lib.ph. NOTA: el vector pcltar.lib.php est\u00e1 actualmente cubierto por CVE-2007-2199."
    }
  ],
  "evaluatorImpact": "Successful exploitation requires that \"register_globals\" is enabled.\r\n",
  "id": "CVE-2007-2660",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-05-14T23:19:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/36010"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25230"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/1786"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/3915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/36010"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/25230"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/1786"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/3915"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.