CVE-2007-1424: High severity Softnews Media Group DataLife Engine vulnerability

Published Mar 13, 2007

Updated

Multiple PHP remote file inclusion vulnerabilities in Softnews Media Group DataLife Engine allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to (1) init.php and (2) Ajax/editnews.php. NOTE: some of these details are obtained from third party information.

Affected Software

2 affected components

Softnews Media Group DataLife Engine=4.1

Softnews Media Group DataLife Engine=5.5

Event History

Mar 13, 2007

CVE Published

01:19 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable over the network and does not require authentication. An attacker can supply a URL through the root_dir parameter to the affected scripts.

What is the likely impact of successful exploitation?

Successful exploitation can allow execution of arbitrary PHP code. This can compromise confidentiality, integrity, and availability of the affected application or server environment.

Which application components should be reviewed?

Review init.php and Ajax/editnews.php for use of the root_dir parameter. The reported issue affects DataLife Engine installations where those scripts accept an attacker-controlled URL in that parameter.

CVE-2007-1424: High severity Softnews Media Group DataLife Engine vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Which application components should be reviewed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Which application components should be reviewed?