CVE-2007-1524: Medium severity Zomplog Zomplog vulnerability

Published Mar 20, 2007

Updated

Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the settings[skin] parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via themes/default/.

Affected Software

1 affected component

Zomplog Zomplog=3.7.6

Event History

Mar 20, 2007

CVE Published

08:19 PM

Mar 21, 2007

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1524?

CVE-2007-1524 has been rated as high severity due to its potential for remote code execution via directory traversal.

How does CVE-2007-1524 exploit work?

CVE-2007-1524 exploits a directory traversal vulnerability that allows attackers to access arbitrary local files through manipulated parameters.

What versions of ZomPlog are affected by CVE-2007-1524?

CVE-2007-1524 affects ZomPlog versions 3.7.6 and earlier.

How can I fix CVE-2007-1524?

To fix CVE-2007-1524, upgrade ZomPlog to a version later than 3.7.6 that addresses this vulnerability.

What are the potential risks of CVE-2007-1524?

The risks of CVE-2007-1524 include the possibility of remote attackers executing arbitrary PHP code on the server.