critical10.0
CVE-2007-1486
PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code…
Impact
PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to admin.php, probably due to a dynamic variable evaluation vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Carbonize | Lazarus Guestbook | through 1.7.2 |
References
- NVD record
- CVE.org record
- http://carbonize.co.uk/Lazarus/Forum/index.php?topic=1164.0
- http://securityreason.com/securityalert/2432
- http://www.attrition.org/pipermail/vim/2007-March/001417.html
- http://www.securityfocus.com/archive/1/462183/100/100/threaded
- http://www.securityfocus.com/archive/1/462235/100/100/threaded
- http://www.securityfocus.com/archive/1/463041/100/0/threaded
- http://www.securityfocus.com/archive/1/469218/100/0/threaded
- http://www.vupen.com/english/advisories/2007/0874
- http://carbonize.co.uk/Lazarus/Forum/index.php?topic=1164.0
- http://securityreason.com/securityalert/2432
- http://www.attrition.org/pipermail/vim/2007-March/001417.html
- http://www.securityfocus.com/archive/1/462183/100/100/threaded
- http://www.securityfocus.com/archive/1/462235/100/100/threaded
- http://www.securityfocus.com/archive/1/463041/100/0/threaded
- http://www.securityfocus.com/archive/1/469218/100/0/threaded
- http://www.vupen.com/english/advisories/2007/0874