CVE-2007-0804

{"id": "CVE-2007-0804", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-02-07T11:28:00.000", "references": [{"url": "http://osvdb.org/35849", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/22412", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/0492", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32211", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/3271", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/35849", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/22412", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2007/0492", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32211", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/3271", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject arbitrary PHP code into arbitrary files via \"..\" sequences in the subpageName parameter, as demonstrated by injecting PHP code into a template file."}, {"lang": "es", "value": "Vulnerabilidad de escalado de directorio en admin/subpages.php de GGCMS 1.1.0 RC1 y versiones anteriores permite a atacantes remotos inyectar c\u00f3digo PHP en ficheros de su elecci\u00f3n mediante secuencias \"..\" (punto punto) en el par\u00e1metro subpageName, como se demuestra inyectando c\u00f3digo PHP en un fichero plantilla."}], "lastModified": "2025-04-09T00:30:58.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ggcms:ggcms:1.1.0_rc1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31E5135C-B0B2-4143-B408-A8C4B90D0B46"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}