Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2006-4548

e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code via the tinyMCE_imglib_include image/jpeg parameter in e107_handlers/tiny_mce/plugins/ibrowser/ibrowser.php, as demonstrated by a multipart/form-data request. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in e107.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 78.0%
CVSS Severity
CVSS v2 Score 7.5
Products affected by CVE-2006-4548
  • E107 » E107 » Version: 0.7
    cpe:2.3:a:e107:e107:0.7
  • E107 » E107 » Version: 0.7.1
    cpe:2.3:a:e107:e107:0.7.1
  • E107 » E107 » Version: 0.7.2
    cpe:2.3:a:e107:e107:0.7.2
  • E107 » E107 » Version: 0.7.3
    cpe:2.3:a:e107:e107:0.7.3
  • E107 » E107 » Version: 0.7.4
    cpe:2.3:a:e107:e107:0.7.4
  • E107 » E107 » Version: 0.7.5
    cpe:2.3:a:e107:e107:0.7.5


Products
Pricing
Contact Us

Shodan ® - All rights reserved