vulnwire
7.5high

CVE-2007-63961 exploit

Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP c…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
1
Exploit-DB

Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the (1) username, (2) password, and (3) email parameters when registering a user account, which can be executed by accessing the user's php file for this account. NOTE: similar code injection might be possible in a user profile.

Exploit prediction (EPSS)

2.41% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

Exploits and detections

  • EDB-4705 Flat PHP Board 1.2 - Multiple Vulnerabilities · webapps · 2007-12-09

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

  • securityfocus.com /archive/1/484803/100/100/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /43675 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exploit-db.com /exploits/4705 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /bid/26782 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.