Unscored severity · published Nov 10, 2007
CVE-2007-5914
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary…
–
CVSS
5.4%
EPSS
No
On KEV
Description
Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter, which can be executed by accessing config.inc.php. NOTE: this can be exploited by unauthenticated remote attackers by leveraging CVE-2007-5913.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
Jbc Explorer · Jean Charles
through 7.20_rc1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5914
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5914
mgsdl.free.fr
http://mgsdl.free.fr/?1:33
osvdb.org
http://osvdb.org/42070
Vendor Advisory
http://secunia.com/advisories/27533
securityreason.com
http://securityreason.com/securityalert/3358
www.securityfocus.com
http://www.securityfocus.com/archive/1/483268/100/0/threaded
www.exploit-db.com
https://www.exploit-db.com/exploits/4608
More from Jbc Explorer
–
CVE-2007-5913
dirsys/modules/auth.php in JBC Explorer 7.20 RC1 and earlier does not require authentication, which allows remote attackers to (1) delete auth.inc.php via the suppr parameter, and…