RCE in Vwar Virtual War

CVE-2007-4605

PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter, a different vector than CVE-2006-1503, CVE-2006-1636, and CVE-2006-1747.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.021 (80.1th percentile) — read the EPSS interpretation.

Affected products

Vwar Virtual_war
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (vdb-entry, x_refsource_XF)