National Cyber-Alert System

Vulnerability Summary for CVE-2007-1458

Overview

Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) inc_checkdate_lang.php, (2) inc_charset_fx.php, (3) inc_config_color.php, (4) inc_currency_set.php, (5) inc_db_makelink.php, (6) inc_diagnostics_report_fx.php, (7) inc_environment_global.php, (8) inc_front_chain_lang.php, (9) inc_init_crypt.php, (10) inc_load_copyrite.php, or (11) inc_news_save.php in include/; (12) diagnostics-report-index.php, (13) config_options_mascot.php, (14) barcode-labels.php, (15) chg-color.php, or (16) config_options_gui_template.php in main/; or unspecified other files.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: care2x-rootpath-file-include(32981)

Hyperlink:http://xforce.iss.net/xforce/xfdb/32981

External Source: BID

Name: 22951

Hyperlink:http://www.securityfocus.com/bid/22951

External Source: BUGTRAQ

Name: 20070314 [ECHO_ADV_72$2007] CARE2X (root_path) Remote File Inclusion Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/462808/100/0/threaded

External Source: OSVDB

Name: 34060

Hyperlink:http://www.osvdb.org/34060

External Source: OSVDB

Name: 34059

Hyperlink:http://www.osvdb.org/34059

External Source: OSVDB

Name: 34058

Hyperlink:http://www.osvdb.org/34058

External Source: OSVDB

Name: 34057

Hyperlink:http://www.osvdb.org/34057

External Source: OSVDB

Name: 34056

Hyperlink:http://www.osvdb.org/34056

External Source: OSVDB

Name: 34055

Hyperlink:http://www.osvdb.org/34055

External Source: OSVDB

Name: 34054

Hyperlink:http://www.osvdb.org/34054

External Source: OSVDB

Name: 34053

Hyperlink:http://www.osvdb.org/34053

External Source: OSVDB

Name: 34052

Hyperlink:http://www.osvdb.org/34052

External Source: OSVDB

Name: 34051

Hyperlink:http://www.osvdb.org/34051

External Source: OSVDB

Name: 34050

Hyperlink:http://www.osvdb.org/34050

External Source: OSVDB

Name: 34049

Hyperlink:http://www.osvdb.org/34049

External Source: OSVDB

Name: 34048

Hyperlink:http://www.osvdb.org/34048

External Source: OSVDB

Name: 34047

Hyperlink:http://www.osvdb.org/34047

External Source: OSVDB

Name: 34046

Hyperlink:http://www.osvdb.org/34046

External Source: OSVDB

Name: 34045

Hyperlink:http://www.osvdb.org/34045

External Source: VUPEN

Name: ADV-2007-0938

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2007/0938

External Source: SECUNIA

Name: 24481

Type: Advisory

Hyperlink:http://secunia.com/advisories/24481

External Source: MISC

Name: http://advisories.echo.or.id/adv/adv72-theday-2007.txt

Hyperlink:http://advisories.echo.or.id/adv/adv72-theday-2007.txt