CVE-2007-1628

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

23/03/2007

Last modified:

09/04/2025

Description

Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the SPL_CFG[dirroot] parameter to (1) service.alert.inc.php or (2) settings.ses.php in inc/; (3) db/mysql/db.inc.php; (4) integration/shortstat/configuration.php; (5) ali.class.php or (6) cat.class.php in methodology/traditional/class/; (7) cat_browse.inc.php, (8) chr_browse.inc.php, (9) chr_display.inc.php, or (10) dash_browse.inc.php in methodology/traditional/ui/inc/; (11) spl.webservice.php or (12) konfabulator/gateway_admin.php in ws/; or other unspecified files.

Impact

Vector 2.0

AV:N/AC:M/Au:N/C:C/I:C/A:C CVSS v2.0 Severity and Metrics:

Base Score: 9.30 HIGH
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Attack Vector (AV): Network
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): Complete
Integrity (I): Complete
Availability (A): Complete

Base Score 2.0

9.30

Severity 2.0

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:studiewijzer:studiewijzer:0.13:::::::*
cpe:2.3:a:studiewijzer:studiewijzer:0.14:::::::*
cpe:2.3:a:studiewijzer:studiewijzer:0.15:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2007-1628

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools