CVE-2005-0887
published 2005-03-24CVE-2005-0887: Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1)…
PriorityP341high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
2.74%
84.3th percentile
Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) functions.inc.php or (2) main.php, which causes code to be injected into an eval statement.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dcl | — | — |
| michael_dean | double_choco_latte | — | — |
| michael_dean | double_choco_latte | — | — |
| michael_dean | double_choco_latte | — | — |
| michael_dean | double_choco_latte | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_debian7.5LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2005-0887: dcl - Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote ...
vendor_debian·2005·CVSS 7.5
CVE-2005-0887 [HIGH] CVE-2005-0887: dcl - Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote ...
Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) functions.inc.php or (2) main.php, which causes code to be injected into an eval statement.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-5wj3-8v9f-vjph: Eval injection vulnerability in Double Choco Latte before 0
ghsa_unreviewed·2022-05-01
CVE-2005-0887 [HIGH] GHSA-5wj3-8v9f-vjph: Eval injection vulnerability in Double Choco Latte before 0
Eval injection vulnerability in Double Choco Latte before 0.9.4.3 allows remote attackers to execute arbitrary PHP code via the menuAction variable in (1) functions.inc.php or (2) main.php, which causes code to be injected into an eval statement.
No detection rules found.
No writeups or analysis indexed.
http://secunia.com/advisories/14688http://securitytracker.com/id?1013559http://sourceforge.net/project/shownotes.php?release_id=315144https://exchange.xforce.ibmcloud.com/vulnerabilities/19806http://secunia.com/advisories/14688http://securitytracker.com/id?1013559http://sourceforge.net/project/shownotes.php?release_id=315144https://exchange.xforce.ibmcloud.com/vulnerabilities/19806
2005-03-24
Published