RCE in Phportal

CVE-2007-4950

PHP remote file inclusion vulnerability in form/db_form/employee.php in PHPortal 0.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter. NOTE: this issue is disputed by CVE, since DOCUMENT_ROOT cannot be modified by an attacker

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.012 (65.5th percentile) — read the EPSS interpretation.

Affected products

  • Phportal — versions 0.2.7
  • N/a — versions n/a

Weakness classification (CWE)

References