vulnwire
7.5high

CVE-2007-65501 exploit

form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.8%
percentile 94%
Public exploits
1
Exploit-DB

form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter.

Exploit prediction (EPSS)

6.84% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

  • EDB-4789 PMOS Help Desk 2.4 - Remote Command Execution · webapps · 2007-12-25

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

  • osvdb.org /42662 · vdb-entry, x_refsource_OSVDB, x_transferred
  • vupen.com /english/advisories/2007/4321 · vdb-entry, x_refsource_VUPEN, x_transferred
  • exploit-db.com /exploits/4789 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • secunia.com /advisories/28201 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/39274 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/27032 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.