PT-2007-3496 · Cabron · Cabron Connector

Dj7Xpl

·

CVE-2007-2154

·

Published

2007-04-19

·

Updated

2017-10-11

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Cabron Connector version 1.1.0
Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the CabronServiceFolder parameter in the services/samples/inclusionService.php file.
Recommendations For Cabron Connector version 1.1.0, consider restricting access to the vulnerable inclusionService.php file until a patch is available. Avoid using the CabronServiceFolder parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2007-2154

Affected Products

Cabron Connector