RCE in Form Tools

CVE-2007-6464

Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP code via a URL in the g_root_dir parameter to (1) admin_page_open.php and (2) client_page_open.php in global/templates/.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.021 (79.5th percentile) — read the EPSS interpretation.

Affected products

  • Form_tools — versions 1.5.0b
  • N/a — versions n/a

Weakness classification (CWE)

References