CVE-2007-2024

{"id": "CVE-2007-2024", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-04-13T18:19:00.000", "references": [{"url": "http://secunia.com/advisories/24888", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/25307", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/26784", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2007/dsa-1371", "source": "cve@mitre.org"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200705-16.xml", "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/914793", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.nabble.com/Fwd%3A-Critical-phpwiki-c99shell-exploit-t3571197.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/465489/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/465514/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/465550/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/1400", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/24888", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/25307", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/26784", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.debian.org/security/2007/dsa-1371", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200705-16.xml", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kb.cert.org/vuls/id/914793", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.nabble.com/Fwd%3A-Critical-phpwiki-c99shell-exploit-t3571197.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/465489/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/465514/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/465550/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2007/1400", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a (1) php3, (2) php4, or (3) php5 extension."}, {"lang": "es", "value": "Vulnerabilidad de actualizaci\u00f3n de archivo en la caracter\u00edstica de actualizaci\u00f3n (lib/plugin/UpLoad.php) en PhpWiki 1.3.x permite a atacantes remotos actualizar archivos PHP de su elecci\u00f3n con extensiones (1) php3, (2) php4, o (3) php5."}], "lastModified": "2025-04-09T00:30:58.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpwiki:phpwiki:1.3.x:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58B94404-6C32-454A-9E42-5A07D6501A0A"}], "operator": "OR"}]}], "evaluatorImpact": "\"Successful exploitation requires being logged in and that the webserver is configured to execute PHP scripts with such extensions. In the default configuration of PhpWiki, no registration or validation is necessary to log in.\"\r\n", "sourceIdentifier": "cve@mitre.org"}