Vulnerabilities > CVE-2007-0804 - Remote PHP Code Execution vulnerability in Ggcms 1.1.0Rc1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
ggcms
exploit available
NVD
Published: 2007-02-07
Updated: 2017-10-19

Summary

Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject arbitrary PHP code into arbitrary files via ".." sequences in the subpageName parameter, as demonstrated by injecting PHP code into a template file.

Vulnerable Configurations

Part Description Count
Application
Ggcms
1

Exploit-Db

descriptionGGCMS <= 1.1.0 RC1 Remote Code Execution Exploit. CVE-2007-0804. Webapps exploit for php platform
fileexploits/php/webapps/3271.php
idEDB-ID:3271
last seen2016-01-31
modified2007-02-05
platformphp
port
published2007-02-05
reporterKacper
sourcehttps://www.exploit-db.com/download/3271/
titleGGCMS <= 1.1.0 RC1 - Remote Code Execution Exploit
typewebapps

References