CVE-2007-4009
Parallels Confixx 2.0.12-3.3.1 - Remote Code Execution via thisdir Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-4009. PoCs published by H4 / XPK.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in Confixx <= PRO 3.3.1 due to an undefined variable $thisdir in saveserver.php. An attacker can include arbitrary remote files and execute commands if allow_url_fopen is enabled and open_basedir is disabled.
Description
PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the thisdir parameter.
Exploits (1)
This exploit demonstrates a remote file inclusion vulnerability in Confixx <= PRO 3.3.1 due to an undefined variable $thisdir in saveserver.php. An attacker can include arbitrary remote files and execute commands if allow_url_fopen is enabled and open_basedir is disabled.