CVE-2007-4187
Joomla! 1.5 beta - Remote Code Execution via com_search searchword Parameter
Title source: llmDescription
Multiple eval injection vulnerabilities in the com_search component in Joomla! 1.5 beta before RC1 (aka Mapya) allow remote attackers to execute arbitrary PHP code via PHP sequences in the searchword parameter, related to default_results.php in (1) components/com_search/views/search/tmpl/ and (2) templates/beez/html/com_search/search/.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/474417/100/100/threaded
Various Sources x_refsource_confirm
http://joomlacode.org/gf/project/joomla/scmsvn/?action=browse&path=%2Fdevelopment%2Ftrunk%2Fcomponents%2Fcom_search%2Fviews%2Fsearch%2Fview.php&r1=7455&r2=7456
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/41260
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/2969
Scores
EPSS
0.1011
EPSS Percentile
93.2%
Details
CWE
CWE-94
Status
published
Products (1)
joomla/joomla
1.5.0_beta
Published
Aug 08, 2007
Tracked Since
Feb 18, 2026