medium6.8Public exploit code
CVE-2007-1525
Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute arbitrary PHP code via the cat paramete…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dayfox Blog 4 - 'postpost.php' Remote Code Execution2007-03-14 · webapps · php · Verified
Impact
Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute arbitrary PHP code via the cat parameter, which can be executed via a request to posts.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dayfox Designs | Dayfox Blog | Version 4 |
References
- NVD record
- CVE.org record
- http://infusion.110mb.com/enter/dfblog4.zip
- http://osvdb.org/34073
- http://secunia.com/advisories/24534
- http://www.securityfocus.com/bid/22972
- http://www.vupen.com/english/advisories/2007/0969
- https://www.exploit-db.com/exploits/3478
- http://infusion.110mb.com/enter/dfblog4.zip
- http://osvdb.org/34073
- http://secunia.com/advisories/24534
- http://www.securityfocus.com/bid/22972
- http://www.vupen.com/english/advisories/2007/0969
- https://www.exploit-db.com/exploits/3478