CVE-2007-6082

EUVD-2007-6051 · Published Nov 22, 2007

Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel, possibly 2.0.3, allows remote attackers to inject arbitrary PHP code via the filecontents parameter, which can be executed by accessing includes/news.php.

Technologies

Sciurus Sciurus Hosting Panel

Weaknesses

CWE-94

CVSS scores

v2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Stealth

T1190Exploit Public-Facing Application T1027.006HTML Smuggling T1027.009Embedded Payloads T1564.009Resource Forking

References

https://www.exploit-db.com/exploits/4635
http://securityreason.com/securityalert/3388
http://www.r57.li/exploit.txt
http://www.securityfocus.com/archive/1/483867/100/0/threaded
http://www.securityfocus.com/bid/26481
https://exchange.xforce.ibmcloud.com/vulnerabilities/38543

Potentially impacted assets

See if this affects your attack surface