CVE-2007-3194: Critical severity myWebland myBloggie vulnerability
DISPUTED Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggierootpath parameter to (1) config.php; (2) db.php, (3) template.php, (4) functions.php, and (5) classes.php in includes/; (6) viewmode.php; and (7) blogbody.php. NOTE: another researcher disputes the vulnerability because the files are protected against direct requests, contain no relevant include statements, or do not exist.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3194?
CVE-2007-3194 is a disputed vulnerability but is often regarded as critical since it allows remote attackers to execute arbitrary PHP code.
How do I fix CVE-2007-3194?
To fix CVE-2007-3194, users should upgrade to a patched version of myBloggie or implement security measures that restrict file inclusion paths.
Which versions of myBloggie are affected by CVE-2007-3194?
CVE-2007-3194 specifically affects myBloggie version 2.1.5.
What types of files can be targeted in the CVE-2007-3194 vulnerability?
CVE-2007-3194 allows the inclusion of critical files such as config.php, db.php, and template.php.
Can CVE-2007-3194 lead to full system compromise?
Yes, if exploited successfully, CVE-2007-3194 can enable attackers to execute arbitrary PHP code, potentially leading to full system compromise.