CVE-2007-1486 - PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before

CVE-2007-1486

Summary

PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to admin.php, probably due to a dynamic variable evaluation vulnerability. This vulnerability has been addressed by the vendor with a product update: http://carbonize.co.uk/Lazarus/downloads.php

References

Vulnerable Configurations

cpe:2.3:a:carbonize:lazarus_guestbook:*:*:*:*:*:*:*:*
cpe:2.3:a:carbonize:lazarus_guestbook:*:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 16-10-2018 - 16:38)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bugtraq	20070307 Lazarus Guestbook (admin.php)Remote File Include Expliot 20070308 Re: [Bogus] Lazarus Guestbook (admin.php)Remote File Include Expliot - 20070316 Re: [Bogus] Lazarus Guestbook (admin.php)Remote File Include Expliot 20070520 Re: Re: [Bogus] Lazarus Guestbook (admin.php)Remote File Include Expliot -
confirm	http://carbonize.co.uk/Lazarus/Forum/index.php?topic=1164.0
sreason	2432
vim	20070307 Bogus - [c_r_ck at hotmail.com: Lazarus Guestbook (admin.php)Remote File Include Expliot]
vupen	ADV-2007-0874

Last major update

16-10-2018 - 16:38

Published

16-03-2007 - 21:19

Last modified

16-10-2018 - 16:38