CVE-2007-1987 - CVE House
Back to Database
Status published High CVE-2007-1987

Multiple PHP remote file inclusion vulnerabilities in PHPEcho CMS 2.0...

Vulnerability Description

Multiple PHP remote file inclusion vulnerabilities in PHPEcho CMS 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) _plugin_file parameter to smarty/internals/core.load_pulgins.php or the (2) root_path parameter to index.php. NOTE: CVE disputes (1) because the inclusion occurs within a function that is not called during a direct request. CVE disputes (2) because root_path is defined in config.php before use

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-1987

Credits & Attribution

No credits recorded in the NVD database.

References

More from phpecho cms

View All →
CVE-2009-2402
SQL injection vulnerability in index.php in the forum module in...
High 7.5
CVE-2009-2401
Cross-site scripting (XSS) vulnerability in PHPEcho CMS 2.0-rc3 allows remote...
Medium 4.3
CVE-2008-0355
SQL injection vulnerability in index.php in the forum module in...
High 7.5
CVE-2007-3335
Multiple SQL injection vulnerabilities in the admin panel in PHPEcho...
High 7.5
CVE-2007-2866
Multiple SQL injection vulnerabilities in modules/admin/modules/gallery.php in PHPEcho CMS 2.0-rc1...
High 7.5

Affected Vendor

phpecho cms

View all reports →

Affected Software

phpecho cms
Vulnerable Versions:
2.0

Timeline

Official Publish: April 12th, 2007
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.