CVE-2007-4935 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-4935
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-4935

Description: Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFL_FILE_ROOT parameter to (1) admin.php, (2) custom_pages.php, (3) draft.php, (4) faq.php, (5) leagues.php, (6) livedraft.php, (7) login.php, (8) my_team.php, (9) profile.php, (10) signup.php, (11) statistics.php, (12) transactions.php, (13) program_files/admin/custom_pages.php, or (14) program_files/common.php. NOTE: the program_files/livedraft/admin.php and program_files/livedraft/livedraft.php vectors are covered by CVE-2007-4934.

CVE Status: Candidate

References: SAID Secunia Advisory: SA26812 OSVDB 39650 39651 39652 39653 39654 39655 39656 39657 39658 39659 39660 MISC http://arfis.wordpress.com/2007/09/14/rfi-02-phpffl-fantasy-football-league-manager/ CONFIRM http://sourceforge.net/project/shownotes.php?release_id=539716&group_id=137531 http://sourceforge.net/forum/forum.php?forum_id=735906

Return to the previous page.