Description

Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter to (1) access/login.php and (2) includes/lang/language.php, different vectors than CVE-2007-4279.

Remediation

References

CVE-2007-5117

Related Vulnerabilities

WordPress Plugin Manage and respond to conversations with leads-HappyForms PHP Object Injection (1.0.0)

WordPress Plugin Answer My Question Cross-Site Scripting (1.3)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-38269)

Drupal Improper Access Control Vulnerability (CVE-2016-3162)

WordPress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-0616)

Severity

Critical

Classification

CVE-2007-5117 CWE-94

Tags

Missing Update Known Vulnerabilities