medium6.8Public exploit code
CVE-2007-2086
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code via a URL in the bj parameter to (1) who…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CNStats 2.9 - 'who_r.php?bj' Remote File Inclusion2007-04-15 · webapps · php · Verified
Impact
Multiple PHP remote file inclusion vulnerabilities in CNStats 2.9 allow remote attackers to execute arbitrary PHP code via a URL in the bj parameter to (1) who_r.php or (2) who_s.php in reports/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cnstats | Cnstats | Version 2.9 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/24902
- http://www.securityfocus.com/bid/23501
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33672
- https://www.exploit-db.com/exploits/3741
- http://secunia.com/advisories/24902
- http://www.securityfocus.com/bid/23501
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33672
- https://www.exploit-db.com/exploits/3741