CVE-2007-2260 - Vulnerability Details - OpenCVE

Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the bibtexrootrel parameter to (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7) importinfo.php, (8) import.php, (9) examplefile.php, (10) clearinfo.php, (11) clear.php, (12) aboutinfo.php, (13) about.php, and other unspecified files.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.02367.

Key SSVC decision points have not yet been added.

Vendors	Products
Bibtex	Mase

Configuration 1 [-]

cpe:2.3:a:bibtex:mase:2.0_beta:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://osvdb.org/35621
http://osvdb.org/35622
http://osvdb.org/35623
http://osvdb.org/35624
http://osvdb.org/35625
http://osvdb.org/35626
http://osvdb.org/35627
http://osvdb.org/35628
http://osvdb.org/35629
http://osvdb.org/35630
http://osvdb.org/35631
http://osvdb.org/35632
http://osvdb.org/35633
http://securityreason.com/securityalert/2624
http://www.securityfocus.com/archive/1/466683/100/0/threaded

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-04-25T17:00:00

Updated: 2024-08-07T13:33:28.150Z

Reserved: 2007-04-25T00:00:00

Link: CVE-2007-2260

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-04-25T17:19:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-2260

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-04-22T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the bibtexrootrel parameter to (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7) importinfo.php, (8) import.php, (9) examplefile.php, (10) clearinfo.php, (11) clear.php, (12) aboutinfo.php, (13) about.php, and other unspecified files."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "35628", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35628"}, {"name": "35624", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35624"}, {"name": "35631", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35631"}, {"name": "35633", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35633"}, {"name": "35629", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35629"}, {"name": "35622", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35622"}, {"name": "35621", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35621"}, {"name": "20070422 bibtex mase Remote File Inclusion", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/466683/100/0/threaded"}, {"name": "35625", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35625"}, {"name": "35623", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35623"}, {"name": "35632", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35632"}, {"name": "2624", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2624"}, {"name": "35626", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35626"}, {"name": "35630", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35630"}, {"name": "35627", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35627"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2260", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the bibtexrootrel parameter to (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7) importinfo.php, (8) import.php, (9) examplefile.php, (10) clearinfo.php, (11) clear.php, (12) aboutinfo.php, (13) about.php, and other unspecified files."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "35628", "refsource": "OSVDB", "url": "http://osvdb.org/35628"}, {"name": "35624", "refsource": "OSVDB", "url": "http://osvdb.org/35624"}, {"name": "35631", "refsource": "OSVDB", "url": "http://osvdb.org/35631"}, {"name": "35633", "refsource": "OSVDB", "url": "http://osvdb.org/35633"}, {"name": "35629", "refsource": "OSVDB", "url": "http://osvdb.org/35629"}, {"name": "35622", "refsource": "OSVDB", "url": "http://osvdb.org/35622"}, {"name": "35621", "refsource": "OSVDB", "url": "http://osvdb.org/35621"}, {"name": "20070422 bibtex mase Remote File Inclusion", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/466683/100/0/threaded"}, {"name": "35625", "refsource": "OSVDB", "url": "http://osvdb.org/35625"}, {"name": "35623", "refsource": "OSVDB", "url": "http://osvdb.org/35623"}, {"name": "35632", "refsource": "OSVDB", "url": "http://osvdb.org/35632"}, {"name": "2624", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2624"}, {"name": "35626", "refsource": "OSVDB", "url": "http://osvdb.org/35626"}, {"name": "35630", "refsource": "OSVDB", "url": "http://osvdb.org/35630"}, {"name": "35627", "refsource": "OSVDB", "url": "http://osvdb.org/35627"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:33:28.150Z"}, "title": "CVE Program Container", "references": [{"name": "35628", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35628"}, {"name": "35624", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35624"}, {"name": "35631", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35631"}, {"name": "35633", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35633"}, {"name": "35629", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35629"}, {"name": "35622", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35622"}, {"name": "35621", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35621"}, {"name": "20070422 bibtex mase Remote File Inclusion", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/466683/100/0/threaded"}, {"name": "35625", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35625"}, {"name": "35623", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35623"}, {"name": "35632", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35632"}, {"name": "2624", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2624"}, {"name": "35626", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35626"}, {"name": "35630", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35630"}, {"name": "35627", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35627"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2260", "datePublished": "2007-04-25T17:00:00", "dateReserved": "2007-04-25T00:00:00", "dateUpdated": "2024-08-07T13:33:28.150Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bibtex:mase:2.0_beta:*:*:*:*:*:*:*", "matchCriteriaId": "C540CEE5-8053-49B0-A60A-A60041438CB5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the bibtexrootrel parameter to (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7) importinfo.php, (8) import.php, (9) examplefile.php, (10) clearinfo.php, (11) clear.php, (12) aboutinfo.php, (13) about.php, and other unspecified files."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inclusi\u00f3n remota de archivo en PHP en bibtex mase beta 2.0 permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n mediante una URL en el par\u00e1metro bibtexrootrel a (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7) importinfo.php, (8) import.php, (9) examplefile.php, (10) clearinfo.php, (11) clear.php, (12) aboutinfo.php, (13) about.php, y otros ficheros no especificados."}], "id": "CVE-2007-2260", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-04-25T17:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/35621"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35622"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35623"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35624"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35625"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35626"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35627"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35628"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35629"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35630"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35631"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35632"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35633"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2624"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/466683/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35621"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35622"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35623"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35624"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35625"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35626"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35627"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35628"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35629"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35630"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35631"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35632"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2624"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/466683/100/0/threaded"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}