CVE-2007-3632: Medium severity Limesurvey LimeSurvey vulnerability
Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a URL in the homedir parameter to (1) OLE/PPS/File.php, (2) OLE/PPS/Root.php, (3) Spreadsheet/Excel/Writer.php, or (4) OLE/PPS.php in admin/classes/pear/; or (5) Worksheet.php, (6) Parser.php, (7) Workbook.php, (8) Format.php, or (9) BIFFwriter.php in admin/classes/pear/Spreadsheet/Excel/Writer/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3632?
CVE-2007-3632 is considered to have a critical severity due to its potential for remote code execution.
How do I fix CVE-2007-3632?
To fix CVE-2007-3632, upgrade LimeSurvey to a version that is not vulnerable, preferably to the latest stable release.
What software is affected by CVE-2007-3632?
CVE-2007-3632 affects LimeSurvey version 1.49RC2.
What type of vulnerability is CVE-2007-3632?
CVE-2007-3632 is a remote file inclusion vulnerability in the LimeSurvey application.
Can CVE-2007-3632 be exploited remotely?
Yes, CVE-2007-3632 can be exploited remotely, allowing attackers to execute arbitrary PHP code.