CVE-2007-1458 Information

Description

Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) inc_checkdate_lang.php (2) inc_charset_fx.php (3) inc_config_color.php (4) inc_currency_set.php (5) inc_db_makelink.php (6) inc_diagnostics_report_fx.php (7) inc_environment_global.php (8) inc_front_chain_lang.php (9) inc_init_crypt.php (10) inc_load_copyrite.php or (11) inc_news_save.php in include/; (12) diagnostics-report-index.php (13) config_options_mascot.php (14) barcode-labels.php (15) chg-color.php or (16) config_options_gui_template.php in main/; or unspecified other files.

Reference

http://advisories.echo.or.id/adv/adv72-theday-2007.txt http://secunia.com/advisories/24481 http://www.osvdb.org/34045 http://www.osvdb.org/34046 http://www.osvdb.org/34047 http://www.osvdb.org/34048 http://www.osvdb.org/34049 http://www.osvdb.org/34050 http://www.osvdb.org/34051 http://www.osvdb.org/34052 http://www.osvdb.org/34053 http://www.osvdb.org/34054 http://www.osvdb.org/34055 http://www.osvdb.org/34056 http://www.osvdb.org/34057 http://www.osvdb.org/34058 http://www.osvdb.org/34059 http://www.osvdb.org/34060 http://www.securityfocus.com/archive/1/462808/100/0/threaded http://www.securityfocus.com/bid/22951 http://www.vupen.com/english/advisories/2007/0938 https://exchange.xforce.ibmcloud.com/vulnerabilities/32981