FKIE_CVE-2007-5641

Vulnerability from fkie_nvd - Published: 2007-10-23 21:47 - Updated: 2026-06-16 22:46
Severity
Summary
Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3) events/index.php, (4) fax/index.php, (5) files/index.php, (6) files/list.php, (7) groupadm/index.php, (8) history/index.php, (9) info/index.php, (10) log/index.php, (11) mail/index.php, (12) messages/index.php, (13) organizations/index.php, (14) phones/index.php, (15) presence/index.php, (16) projects/index.php, (17) projects/summary.inc.php, (18) projects/list.php, (19) reports/index.php, (20) search/index.php, (21) snf/index.php, (22) syslog/index.php, (23) tasks/searchsimilar.php, (24) tasks/index.php, (25) tasks/summary.inc.php, and (26) useradm/index.php in modules; (27) /ajax/loadsplash.php; (28) /blocks/birthday.php; (29) /blocks/events.php; and (30) /blocks/help.php.
References
cve@mitre.orghttp://osvdb.org/41905
cve@mitre.orghttp://osvdb.org/41906
cve@mitre.orghttp://osvdb.org/41907
cve@mitre.orghttp://osvdb.org/41908
cve@mitre.orghttp://osvdb.org/41909
cve@mitre.orghttp://osvdb.org/41910
cve@mitre.orghttp://osvdb.org/41912
cve@mitre.orghttp://osvdb.org/41913
cve@mitre.orghttp://osvdb.org/41914
cve@mitre.orghttp://osvdb.org/41917
cve@mitre.orghttp://osvdb.org/41918
cve@mitre.orghttp://osvdb.org/41920
cve@mitre.orghttp://osvdb.org/41925
cve@mitre.orghttp://osvdb.org/41927
cve@mitre.orghttp://osvdb.org/41928
cve@mitre.orghttp://osvdb.org/41931
cve@mitre.orghttp://osvdb.org/41934
cve@mitre.orghttp://osvdb.org/41957
cve@mitre.orghttp://osvdb.org/41975
cve@mitre.orghttp://secunia.com/advisories/27347Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/26150
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/37347
cve@mitre.orghttps://www.exploit-db.com/exploits/4549
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41905
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41906
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41907
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41908
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41909
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41910
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41912
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41913
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41914
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41917
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41918
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41920
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41925
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41927
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41928
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41931
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41934
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41957
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41975
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27347Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/26150
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/37347
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/4549
Impacted products
Vendor Product Version
phppm php_project_management *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phppm:php_project_management:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "17DDFEBB-BA6E-42D4-93CD-38AB4B2995F2",
              "versionEndIncluding": "0.8.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the full_path parameter to (1) certinfo/index.php, (2) emails/index.php, (3) events/index.php, (4) fax/index.php, (5) files/index.php, (6) files/list.php, (7) groupadm/index.php, (8) history/index.php, (9) info/index.php, (10) log/index.php, (11) mail/index.php, (12) messages/index.php, (13) organizations/index.php, (14) phones/index.php, (15) presence/index.php, (16) projects/index.php, (17) projects/summary.inc.php, (18) projects/list.php, (19) reports/index.php, (20) search/index.php, (21) snf/index.php, (22) syslog/index.php, (23) tasks/searchsimilar.php, (24) tasks/index.php, (25) tasks/summary.inc.php, and (26) useradm/index.php in modules; (27) /ajax/loadsplash.php; (28) /blocks/birthday.php; (29) /blocks/events.php; and (30) /blocks/help.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de inclusi\u00f3n de archivos remotos PHP en PHP Project Management versiones 0.8.10 y anteriores, permiten a atacantes remotos ejecutar c\u00f3digo PHP arbitrario por medio de una URL en el par\u00e1metro full_path en los archivos (1) certinfo/index.php, (2) emails/index.php, (3) events/index.php, (4) fax/index.php, (5) files/index.php, (6) files/list.php, (7) groupadm/index.php, (8) history/index.php, (9) info/index.php, (10) log/index.php, (11) mail/index.php, (12) index.php, (13) organizations/index.php, (14) phones/index.php, (15) presence/index.php, (16) projects/index.php, (17) projects/summary.inc.php, (18) projects/list.php, (19) reports/index.php, (20) search/index.php, (21) snf/index., (22) syslog/index.php, (23) tasks/searchsimilar.php, (24) tasks/index.php, (25) tasks/summary.inc.php y (26) useradm/index.php en m\u00f3dulos; (27) archivo /ajax/loadsplash.php; (28) archivo /blocks/birthday.php; (29) archivo /blocks/events.php; y (30) archivo /blocks/help.php."
    }
  ],
  "id": "CVE-2007-5641",
  "lastModified": "2026-06-16T22:46:33.250",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-10-23T21:47:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41905"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41906"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41907"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41908"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41909"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41910"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41912"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41913"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41914"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41917"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41918"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41920"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41925"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41927"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41928"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41931"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41934"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41957"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41975"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27347"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/26150"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37347"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/4549"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41905"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41906"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41907"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41908"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41909"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41910"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41912"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41913"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41914"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41917"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41918"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41920"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41925"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41927"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41928"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41931"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41934"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41957"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41975"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/27347"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/26150"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37347"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/4549"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.