CVE-2007-5128: Input Validation
SimpNews 2.41.03 on Windows, when PHP before 5.0.0 is used, allows remote attackers to obtain sensitive information via an certain linkdate parameter to events.php, which reveals the path in an error message due to an unsupported argument type for the mktime function on Windows.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5128?
CVE-2007-5128 is considered a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2007-5128?
To fix CVE-2007-5128, upgrade to a version of PHP greater than 5.0.0 and ensure that you are using an updated version of SimpNews.
What types of systems are affected by CVE-2007-5128?
CVE-2007-5128 affects systems running SimpNews version 2.41.03 and PHP versions up to 5.0.0 on Windows.
What can an attacker gain from exploiting CVE-2007-5128?
An attacker exploiting CVE-2007-5128 can obtain sensitive information, such as the file path from error messages.
What is the impact of CVE-2007-5128 on my application?
The impact of CVE-2007-5128 on your application includes the risk of exposing sensitive path information, which could aid further attacks.