critical9.0Public exploit code
CVE-2007-1635
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Net Portal Dynamic System (NPDS) 5.10 - Remote Code Execution (1)2007-03-18 · webapps · php · Verified
Impact
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a "ConfigSave" op to admin.php, which can later be accessed via a "Configure" op to admin.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Net Portal Dynamic System | Net Portal Dynamic System | through 5.10 |
References
- NVD record
- CVE.org record
- http://osvdb.org/34303
- http://secunia.com/advisories/24571
- http://securityreason.com/securityalert/2473
- http://www.securityfocus.com/archive/1/463176/100/0/threaded
- http://osvdb.org/34303
- http://secunia.com/advisories/24571
- http://securityreason.com/securityalert/2473
- http://www.securityfocus.com/archive/1/463176/100/0/threaded