medium6.8Public exploit code
CVE-2007-5600
Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathn…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Artmedic CMS 3.4 - 'index.php' Local File Inclusion2007-10-16 · webapps · php · Verified
Impact
Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftps, (3) ssh2.sftp, or (4) ssh2.scp URL, in the page parameter, for which PHP remote file inclusion is blocked only for http, https, and ftp URLs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Artmedic Webdesign | Artmedic Cms | through 3.4 |