Unscored severity · published Oct 23, 2007
CVE-2007-5642
Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a
–
CVSS
6.2%
EPSS
No
On KEV
Description
Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the def_lang parameter to modules/files/list.php; the m_path parameter to (2) modules/projects/summary.inc.php or (3) modules/tasks/summary.inc.php; (4) the module parameter to modules/projects/list.php; or the module parameter to index.php in the (5) certinfo, (6) emails, (7) events, (8) fax, (9) files, (10) groupadm, (11) history, (12) info, (13) log, (14) mail, (15) messages, (16) organizations, (17) phones, (18) presence, (19) projects, (20) reports, (21) search, (22) snf, (23) syslog, (24) tasks, or (25) useradm subdirectory of modules/.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Php Project Management · Phppm
through 0.8.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5642
osvdb.org
http://osvdb.org/41951
osvdb.org
http://osvdb.org/41954
osvdb.org
http://osvdb.org/41955
osvdb.org
http://osvdb.org/41956
osvdb.org
http://osvdb.org/41960
osvdb.org
http://osvdb.org/41963
More from Php Project Management
–
CVE-2007-5641
Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path…