CVE-2007-2609 Information

Description

Multiple PHP remote file inclusion vulnerabilities in gnuedu 1.3b2 allow remote attackers to execute arbitrary PHP code via a URL in the (a) ETCDIR parameter to (1) libs/lom.php; (2) lom_update.php (3) check-lom.php and (4) weigh_keywords.php in scripts/; the (b) LIBSDIR parameter to (5) logout.php (6) help.php (7) index.php (8) login.php; and the ETCDIR parameter to (9) web/lom.php.

Reference

http://osvdb.org/38248 http://osvdb.org/38249 http://osvdb.org/38250 http://osvdb.org/38251 http://osvdb.org/38252 http://osvdb.org/38253 http://osvdb.org/38254 http://osvdb.org/38255 http://osvdb.org/38256 http://www.securityfocus.com/bid/23883 http://www.vupen.com/english/advisories/2007/1736 https://exchange.xforce.ibmcloud.com/vulnerabilities/34174 https://www.exploit-db.com/exploits/3876