|
|
CVE Reference: CVE-2007-4935 |
|
| NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE. | |
|
Original Page at CVE MITRE: CVE-2007-4935 |
|
|
Description: Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFL_FILE_ROOT parameter to (1) admin.php, (2) custom_pages.php, (3) draft.php, (4) faq.php, (5) leagues.php, (6) livedraft.php, (7) login.php, (8) my_team.php, (9) profile.php, (10) signup.php, (11) statistics.php, (12) transactions.php, (13) program_files/admin/custom_pages.php, or (14) program_files/common.php. NOTE: the program_files/livedraft/admin.php and program_files/livedraft/livedraft.php vectors are covered by CVE-2007-4934. |
|
|
CVE Status: Candidate |
|
|
References: SAID Secunia Advisory: SA26812 OSVDB 39650 39651 39652 39653 39654 39655 39656 39657 39658 39659 39660 MISC http://arfis.wordpress.com/2007/09/14/rfi-02-phpffl-fantasy-football-league-manager/ CONFIRM http://sourceforge.net/project/shownotes.php?release_id=539716&group_id=137531 http://sourceforge.net/forum/forum.php?forum_id=735906 |
|
| Return to the previous page. |
