CVE-2007-2358: High severity b2evolution b2evolution vulnerability
DISPUTED Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the (1) incpath parameter to (a) anoskin.php, (b) astub.php, (c) admin.php, (d) contact.php, (e) default.php, (f) index.php, and (g) multiblogs.php in blogs/; the (2) viewpath and (3) controlpath parameters to blogs/admin.php; and the (4) skinspath parameter to (h) blogs/contact.php and (i) blogs/multiblogs.php. NOTE: this issue is disputed by CVE, since the incpath, viewpath, controlpath, and skinspath variables are all initialized in conf/advanced.php before they are used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2358?
CVE-2007-2358 is classified as a medium severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2007-2358?
To mitigate CVE-2007-2358, you should upgrade to the latest version of b2evolution that addresses this vulnerability.
What are the potential impacts of CVE-2007-2358?
Exploitation of CVE-2007-2358 can lead to remote code execution, allowing attackers to run arbitrary PHP code on the affected server.
Which versions of b2evolution are affected by CVE-2007-2358?
CVE-2007-2358 affects multiple versions of b2evolution prior to the vulnerability being patched.
How does CVE-2007-2358 work?
CVE-2007-2358 exploits multiple PHP remote file inclusion vulnerabilities via unsanitized user input in the inc_path parameter.