PT-2007-4165 · Saxon · Saxon
CVE-2007-2861
·
Published
2007-05-24
·
Updated
2024-02-14
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SAXON version 4.6
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL in the
template parameter to specific PHP files, including (1) "news.php", (2) "preview.php", or (3) "archive-display.php".Recommendations
For SAXON version 4.6, consider restricting access to the
template parameter in the affected PHP files until a patch is available. As a temporary workaround, avoid using the template parameter in the "news.php", "preview.php", and "archive-display.php" files to minimize the risk of exploitation.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Saxon