CVE-2007-2660
Vulnerability from cvelistv5
Published
2007-05-14 23:00
Modified
2024-08-07 13:49
Severity ?
Summary
PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199
References
cve@mitre.orghttp://osvdb.org/36010
cve@mitre.orghttp://secunia.com/advisories/25230Vendor Advisory
cve@mitre.orghttp://www.attrition.org/pipermail/vim/2007-May/001618.html
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/1786
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/34273
cve@mitre.orghttps://www.exploit-db.com/exploits/3915
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/36010
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25230Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.attrition.org/pipermail/vim/2007-May/001618.html
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/1786
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/34273
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/3915
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:49:57.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "25230",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25230"
          },
          {
            "name": "ADV-2007-1786",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/1786"
          },
          {
            "name": "20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFI",
            "tags": [
              "mailing-list",
              "x_refsource_VIM",
              "x_transferred"
            ],
            "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
          },
          {
            "name": "cjgexplorerpro-pcltarpcltrace-file-include(34273)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
          },
          {
            "name": "3915",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/3915"
          },
          {
            "name": "36010",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36010"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "25230",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25230"
        },
        {
          "name": "ADV-2007-1786",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/1786"
        },
        {
          "name": "20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFI",
          "tags": [
            "mailing-list",
            "x_refsource_VIM"
          ],
          "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
        },
        {
          "name": "cjgexplorerpro-pcltarpcltrace-file-include(34273)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
        },
        {
          "name": "3915",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/3915"
        },
        {
          "name": "36010",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36010"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-2660",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED **  PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "25230",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25230"
            },
            {
              "name": "ADV-2007-1786",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/1786"
            },
            {
              "name": "20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFI",
              "refsource": "VIM",
              "url": "http://www.attrition.org/pipermail/vim/2007-May/001618.html"
            },
            {
              "name": "cjgexplorerpro-pcltarpcltrace-file-include(34273)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34273"
            },
            {
              "name": "3915",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/3915"
            },
            {
              "name": "36010",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/36010"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-2660",
    "datePublished": "2007-05-14T23:00:00",
    "dateReserved": "2007-05-14T00:00:00",
    "dateUpdated": "2024-08-07T13:49:57.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2007-2660\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2007-05-14T23:19:00.000\",\"lastModified\":\"2024-11-21T00:31:20.783\",\"vulnStatus\":\"Modified\",\"cveTags\":[{\"sourceIdentifier\":\"cve@mitre.org\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter.  NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php.  NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199\"},{\"lang\":\"es\",\"value\":\"** IMPUGNADO ** Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en pcltrace.lib.php en el m\u00f3dulo PclTar en Vincent Blavet PhpConcept Library, seg\u00fan utilizado en CJG EXPLORER PRO 3.3 y anteriores y posiblemente otros productos, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s de una URL en el par\u00e1metro g_pcltar_lib_dir. NOTA: CVE impugna este asunto puesto que no hay ninguna declaraci\u00f3n en pcltrace.lib.ph. NOTA: el vector pcltar.lib.php est\u00e1 actualmente cubierto por CVE-2007-2199.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cjg_explorer_pro:cjg_explorer_pro:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.3\",\"matchCriteriaId\":\"C6940066-C9C1-4407-B923-E8F89AC26711\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vincent_blavet:phpconcept_library:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"947C7344-2725-46E4-891F-4A2B0510764C\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/36010\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/25230\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.attrition.org/pipermail/vim/2007-May/001618.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/1786\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/34273\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.exploit-db.com/exploits/3915\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/36010\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/25230\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.attrition.org/pipermail/vim/2007-May/001618.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/1786\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/34273\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.exploit-db.com/exploits/3915\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorImpact\":\"Successful exploitation requires that \\\"register_globals\\\" is enabled.\\r\\n\"}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.