Vulnerability Description
Multiple PHP remote file inclusion vulnerabilities in dedi-group Der Dirigent 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the dedi_path parameter to (1) inc.generate_code.php, (2) fnc.type_forms.php, or (3) fnc.type.php in backend/inc/, or (4) frontend.php or (5) backend.php in projekt01/cms/inc/; or (6) the this_dir parameter to backend/inc/class.filemanager.php. NOTE: vectors 4 and 5 are disputed by CVE because PHP encounters a fatal function-call error on a direct request for the file, before reaching the include statement.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Der Dirigent | Der Dirigent | 1.0 |
Related Weaknesses (CWE)
References
- http://arfis.wordpress.com/2007/09/14/rfi-02-der-dirigent/
- http://osvdb.org/45535
- http://osvdb.org/45536
- http://osvdb.org/45537
- http://osvdb.org/45538
- http://osvdb.org/45539
- http://osvdb.org/45540
- http://arfis.wordpress.com/2007/09/14/rfi-02-der-dirigent/
- http://osvdb.org/45535
- http://osvdb.org/45536
- http://osvdb.org/45537
- http://osvdb.org/45538
- http://osvdb.org/45539
- http://osvdb.org/45540
FAQ
What is CVE-2007-5146?
CVE-2007-5146 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Multiple PHP remote file inclusion vulnerabilities in dedi-group Der Dirigent 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the dedi_path parameter to (1) inc.generate_code.php...
How severe is CVE-2007-5146?
CVE-2007-5146 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-5146?
Check the references section above for vendor advisories and patch information. Affected products include: Der Dirigent Der Dirigent.