high7.5Public exploit code
CVE-2007-2988
A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which all…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Inout Search Engine - Remote Code Execution2007-05-29 · webapps · php · Verified
Impact
A certain admin script in Inout Meta Search Engine sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a request to admin/create_engine.php followed by a request to admin/generate_tabs.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Inout Scripts | Inout Meta Search Engine | All versions |
References
- NVD record
- CVE.org record
- http://osvdb.org/42034
- http://securityreason.com/securityalert/2763
- http://www.securityfocus.com/archive/1/469808/100/0/threaded
- http://www.securityfocus.com/bid/24189
- http://www.securityfocus.com/bid/24199
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34563
- https://www.exploit-db.com/exploits/4004
- http://osvdb.org/42034
- http://securityreason.com/securityalert/2763
- http://www.securityfocus.com/archive/1/469808/100/0/threaded
- http://www.securityfocus.com/bid/24189
- http://www.securityfocus.com/bid/24199
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34563
- https://www.exploit-db.com/exploits/4004