PT-2007-5222 · Swsoft · Swsoft Confixx Pro

H4

·

CVE-2007-4009

·

Published

2007-07-26

·

Updated

2024-02-14

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: SWSoft Confixx Pro versions 2.0.12 through 3.3.1
Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the thisdir parameter in the admin/business inc/saveserver.php file.
Recommendations: For SWSoft Confixx Pro versions 2.0.12 through 3.3.1, consider restricting access to the saveserver.php file until a patch is available. As a temporary workaround, avoid using the thisdir parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-4009

Affected Products

Swsoft Confixx Pro