RCE in Auracms

CVE-2007-4886

Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.021 (79.5th percentile) — read the EPSS interpretation.

Affected products

  • Auracms — versions 1.0, 1.1, 1.2
  • N/a — versions n/a

Weakness classification (CWE)

References