CVE-2007-1790 Information

Description

Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to execute arbitrary PHP code via a URL in the install_root parameter to (1) support.inc.php (2) function.inc.php (3) rdal_object.inc.php (4) rdal_editor.inc.php. (5) login.inc.php (6) request.inc.php and (7) categories.inc.php in include/core/; (8) save.inc.php (9) preview.inc.php (10) edit_item.inc.php (11) new_item.inc.php and (12) item_info.inc.php in include/display/item/; (13) search.inc.php (14) item_edit.inc.php (15) register_succsess.inc.php (16) context_menu.inc.php (17) item_repost.inc.php (18) balance.inc.php (19) featured.inc.php (20) user.inc.php (21) buynow.inc.php (22) install_complete.inc.php (23) fees_info.inc.php (24) user_feedback.inc.php (25) admin_balance.inc.php (26) activate.inc.php (27) user_info.inc.php (28) member.inc.php (29) add_bid.inc.php (30) items_filter.inc.php (31) my_info.inc.php (32) register.inc.php (33) leave_feedback.inc.php and (34) user_auctions.inc.php in include/display/; and (35) design/form.inc.php (36) processor.inc.php (37) interfaces.inc.php (38) left_menu.inc.php (39) login.inc.php and (40) categories.inc.php in include/.

Reference

http://secunia.com/advisories/24696 http://www.osvdb.org/34545 http://www.osvdb.org/34546 http://www.osvdb.org/34547 http://www.osvdb.org/34548 http://www.osvdb.org/34549 http://www.osvdb.org/34550 http://www.osvdb.org/34551 http://www.osvdb.org/34552 http://www.osvdb.org/34553 http://www.osvdb.org/34554 http://www.osvdb.org/34555 http://www.osvdb.org/34556 http://www.osvdb.org/34557 http://www.osvdb.org/34558 http://www.osvdb.org/34559 http://www.osvdb.org/34560 http://www.osvdb.org/34561 http://www.osvdb.org/34562 http://www.osvdb.org/34563 http://www.osvdb.org/34564 http://www.osvdb.org/34565 http://www.osvdb.org/34566 http://www.osvdb.org/34567 http://www.osvdb.org/34568 http://www.osvdb.org/34569 http://www.osvdb.org/34570 http://www.osvdb.org/34571 http://www.osvdb.org/34572 http://www.osvdb.org/34573 http://www.osvdb.org/34574 http://www.osvdb.org/34575 http://www.osvdb.org/34576 http://www.osvdb.org/34577 http://www.osvdb.org/34578 http://www.osvdb.org/34579 http://www.osvdb.org/34580 http://www.osvdb.org/34581 http://www.osvdb.org/34582 http://www.osvdb.org/34583 http://www.osvdb.org/34584 http://www.securityfocus.com/bid/23211 http://www.vupen.com/english/advisories/2007/1180 https://exchange.xforce.ibmcloud.com/vulnerabilities/33335 https://www.exploit-db.com/exploits/3607