36010vdb entry
http://osvdb.org/36010 CVE-2007-2660
CJG EXPLORER PRO 3.2 - 'g_pcltar_lib_dir' Remote File Inclusion
Record summary
CVE-2007-2660 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit.
Description
PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBCJG EXPLORER PRO 3.2 - 'g_pcltar_lib_dir' Remote File InclusionExploitDB exploitby MogatilNot analyzed1 file
References
725230Third-party advisory
http://secunia.com/advisories/25230 20070514 shared code incolving pcltar.lib.php/g_pcltar_lib_dir RFImailing list
http://www.attrition.org/pipermail/vim/2007-May/001618.html ADV-2007-1786vdb entry
http://www.vupen.com/english/advisories/2007/1786 cjgexplorerpro-pcltarpcltrace-file-include(34273)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34273 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2007-2660 3915exploit
https://www.exploit-db.com/exploits/3915