Unscored severity · published Oct 3, 2007
CVE-2007-5173
PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the…
–
CVSS
2.8%
EPSS
No
On KEV
Description
PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openid_root_path parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openid · Openid
0.2.0 · source: NVD
PH
Phpbb · Phpbb
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5173
osvdb.org
http://osvdb.org/37419
secunia.com
http://secunia.com/advisories/27001
www.securityfocus.com
http://www.securityfocus.com/archive/1/481215/100/0/threaded
Exploit
http://www.securityfocus.com/bid/25867
www.vupen.com
http://www.vupen.com/english/advisories/2007/3330
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/36876
More from Openid
5.9
CVE-2008-3280
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166)
–
CVE-2007-1651
Cross-site request forgery (CSRF) vulnerability in OpenID allows remote attackers to restore the login session of a user on an OpenID enabled site via unspecified vectors related…
–
CVE-2007-1652
OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, and add it site to the trusted sites list…