Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-1060. PoCs published by K-159.
AI-analyzed exploit summary This is a writeup detailing a remote file inclusion vulnerability in SendStudio <= 2004.14. The vulnerability arises from unsanitized $ROOTDIR variables in createemails.inc.php and send_emails.inc.php, allowing remote code execution when register_globals and allow_url_fopen are enabled.
Description
Multiple PHP remote file inclusion vulnerabilities in Interspire SendStudio 2004.14 and earlier, when register_globals and allow_fopenurl are enabled, allow remote attackers to execute arbitrary PHP code via a URL in the ROOTDIR parameter to (1) createemails.inc.php and (2) send_emails.inc.php in /admin/includes/.
Exploits (1)
This is a writeup detailing a remote file inclusion vulnerability in SendStudio <= 2004.14. The vulnerability arises from unsanitized $ROOTDIR variables in createemails.inc.php and send_emails.inc.php, allowing remote code execution when register_globals and allow_url_fopen are enabled.