First published: Sat Aug 25 2007(Updated: )
** DISPUTED ** PHP remote file inclusion vulnerability in inc-calcul.php3 in SPIP 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the squelette_cache parameter, a different vector than CVE-2006-1702. NOTE: this issue has been disputed by third party researchers, stating that the squelette_cache variable is initialized before use, and is only used within the scope of a function.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
SPIP SPIP | =1.7.2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2007-4525 is considered low due to the disputed nature of the vulnerability.
To fix CVE-2007-4525, users should upgrade to a patched version of SPIP beyond 1.7.2.
CVE-2007-4525 is classified as a remote file inclusion vulnerability.
CVE-2007-4525 affects SPIP version 1.7.2.
Yes, CVE-2007-4525 may allow remote code execution if exploited.