Vulnerabilities > CVE-2007-1486 - Remote Security vulnerability in Lazarus Guestbook

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
carbonize
critical
NVD
Published: 2007-03-16
Updated: 2018-10-16

Summary

PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to admin.php, probably due to a dynamic variable evaluation vulnerability. This vulnerability has been addressed by the vendor with a product update: http://carbonize.co.uk/Lazarus/downloads.php

Vulnerable Configurations

Part Description Count
Application
Carbonize
1

References