// For flags

CVE-2007-5733

Japanese PHP Gallery Hosting - Arbitrary File Upload

Severity Score

7.5
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attackers to upload and execute arbitrary PHP code via a ServerPath parameter specifying a filename with a double extension. NOTE: some of these details are obtained from third party information.

Vulnerabilidad de actualización de archivo en upload/upload.php en Japanese PHP Gallery Hosting,cuando el modo directorio Open está activado, permite a atacantes remotos actualizar y ejecutar código PHP de su elección a través de un parámetro ServerPath especificando un nombre de archivo con una extensión doble. NOTA: algunos de estos detalles se obtuvieron de una tercera fuente de información.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-10-23 First Exploit
  • 2007-10-30 CVE Reserved
  • 2007-10-30 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-09-02 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Japanese Php Gallery Hosting
Search vendor "Japanese Php Gallery Hosting"
 Japanese Php Gallery Hosting
Search vendor "Japanese Php Gallery Hosting" for product "Japanese Php Gallery Hosting"
*-
Affected