CVE-2007-4738: Code Injection
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) dbconf or (2) ADODBDIR parameter to utils/stphpimageshow.php; or a URL in the STPHPLIBDIR parameter to (3) stphpbutton.php, (4) stphpcheckbox.php, (5) stphpcheckboxwithcaption.php, (6) stphpcheckgroup.php, (7) stphpcomponent.php, (8) stphpcontrolwithcaption.php, (9) stphpedit.php, (10) stphpeditwithcaption.php, (11) stphphr.php, (12) stphpimage.php, (13) stphpimagewithcaption.php, (14) stphplabel.php, (15) stphplistbox.php, (16) stphplistboxwithcaption.php, (17) stphplocale.php, (18) stphppanel.php, (19) stphpradiobutton.php, (20) stphpradiobuttonwithcaption.php, (21) stphpradiogroup.php, (22) stphprichbutton.php, (23) stphpspacer.php, (24) stphptable.php, (25) stphptablecell.php, (26) stphptablerow.php, (27) stphptabpanel.php, (28) stphptabtitle.php, (29) stphptextarea.php, (30) stphptextareawithcaption.php, (31) stphptoolbar.php, (32) stphpwindow.php, (33) stphpxmldoc.php, or (34) stphpxmlelement.php, a different set of vectors than CVE-2007-4737. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4738?
CVE-2007-4738 is considered a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2007-4738?
To fix CVE-2007-4738, upgrade your SpeedTech PHP Library to a version later than 0.8.0 that does not exhibit this vulnerability.
What causes CVE-2007-4738?
CVE-2007-4738 is caused by multiple PHP remote file inclusion vulnerabilities that allow remote attackers to execute arbitrary PHP code.
What are the affected components of CVE-2007-4738?
The affected components of CVE-2007-4738 include utils/stphpimage_show.php and stphpbutton.php in the SpeedTech PHP Library 0.8.0.
Who is impacted by CVE-2007-4738?
Users of SpeedTech PHP Library version 0.8.0 are impacted by CVE-2007-4738, particularly those using the vulnerable parameters.