CVE-2007-4886

Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs.

Link	Resource
http://www.auracms.org/?pilih=news&aksi=lihat&id=117
http://osvdb.org/40506
https://www.exploit-db.com/exploits/4390

Configuration 1

cpe:2.3:a:auracms:auracms:1.5:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:1.0:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:2.0:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:1.1:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:1.2:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:1.6_beta:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:1.3:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:2.1:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:1.61:*:*:*:*:*:*:* cpe:2.3:a:auracms:auracms:1.62:*:*:*:*:*:*:*

---

Published : 2007-09-14 12:17

Updated : 2017-09-29 01:29

---

NVD link : CVE-2007-4886

Mitre link : CVE-2007-4886

No products.

CWE-94