Intrusion PreventionXoops.Horoscope.Module.Footer.PHP.File.Inclusion
Description
The Horoscope 1.0 module for XOOPS has a remote file inclusion vulnerability. A remote attacker could execute an arbitrary script on a vulnerable web server with the privileges of the server, via a specially crafted URL request to the 'footer.php' script using the 'xoopsConfig[root_path]' parameter to specify a malicious PHP file from a remote system.
Affected Products
Horoscope (module for Xoops) version 2.0.0 and prior.
Impact
System compromise.
Recommended Actions
Currently we are not aware of any official supplied fix for this issue.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 14742 |
| Created | Jul 04, 2007 |
| Updated | Nov 15, 2021 |
| Risk |
|
| CVE ID | CVE-2007-3236 |
| Exploit Prediction Score | 66.62% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux, BSD, Solaris, MacOS |
| Affected App | PHP_app |