CVE-2007-2457
published 2007-05-02CVE-2007-2457: PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to execute arbitrary PHP…
PriorityP349high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
11.78%
95.6th percentile
PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to execute arbitrary PHP code via a URL in the cfg[sys][base_path] parameter.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
| pixaria | pixaria_gallery | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cr23-vq27-p59f: Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2007-2458 [HIGH] CWE-94 GHSA-cr23-vq27-p59f: Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1
Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg[sys][base_path] parameter to psg.smarty.lib.php and certain include and library scripts, a different vector than CVE-2007-2457.
GHSA
GHSA-qvxr-389g-385v: PHP remote file inclusion vulnerability in resources/includes/class
ghsa_unreviewed·2022-05-01
CVE-2007-2457 [HIGH] GHSA-qvxr-389g-385v: PHP remote file inclusion vulnerability in resources/includes/class
PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to execute arbitrary PHP code via a URL in the cfg[sys][base_path] parameter.
No detection rules found.
No writeups or analysis indexed.
http://osvdb.org/34976http://pixaria.com/index.history.phphttp://secunia.com/advisories/24821http://www.pixaria.com/news/article/70/http://www.pixaria.com/news/article/71/http://www.securityfocus.com/archive/1/465847/100/200/threadedhttp://www.securityfocus.com/bid/23489http://www.vupen.com/english/advisories/2007/1390https://exchange.xforce.ibmcloud.com/vulnerabilities/33662https://www.exploit-db.com/exploits/3733http://osvdb.org/34976http://pixaria.com/index.history.phphttp://secunia.com/advisories/24821http://www.pixaria.com/news/article/70/http://www.pixaria.com/news/article/71/http://www.securityfocus.com/archive/1/465847/100/200/threadedhttp://www.securityfocus.com/bid/23489http://www.vupen.com/english/advisories/2007/1390https://exchange.xforce.ibmcloud.com/vulnerabilities/33662https://www.exploit-db.com/exploits/3733
2007-05-02
Published