FKIE_CVE-2007-5642

Vulnerability from fkie_nvd - Published: 2007-10-23 21:47 - Updated: 2026-06-16 22:46
Severity
Summary
Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the def_lang parameter to modules/files/list.php; the m_path parameter to (2) modules/projects/summary.inc.php or (3) modules/tasks/summary.inc.php; (4) the module parameter to modules/projects/list.php; or the module parameter to index.php in the (5) certinfo, (6) emails, (7) events, (8) fax, (9) files, (10) groupadm, (11) history, (12) info, (13) log, (14) mail, (15) messages, (16) organizations, (17) phones, (18) presence, (19) projects, (20) reports, (21) search, (22) snf, (23) syslog, (24) tasks, or (25) useradm subdirectory of modules/.
References
cve@mitre.orghttp://osvdb.org/41951
cve@mitre.orghttp://osvdb.org/41954
cve@mitre.orghttp://osvdb.org/41955
cve@mitre.orghttp://osvdb.org/41956
cve@mitre.orghttp://osvdb.org/41960
cve@mitre.orghttp://osvdb.org/41963
cve@mitre.orghttp://osvdb.org/41970
cve@mitre.orghttp://osvdb.org/41972
cve@mitre.orghttp://osvdb.org/41974
cve@mitre.orghttp://osvdb.org/41975
cve@mitre.orghttp://secunia.com/advisories/27347
cve@mitre.orghttp://www.securityfocus.com/bid/26148
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/37348
cve@mitre.orghttps://www.exploit-db.com/exploits/4549
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41951
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41954
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41955
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41956
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41960
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41963
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41970
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41972
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41974
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/41975
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27347
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/26148
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/37348
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/4549
Impacted products
Vendor Product Version
phppm php_project_management *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phppm:php_project_management:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "17DDFEBB-BA6E-42D4-93CD-38AB4B2995F2",
              "versionEndIncluding": "0.8.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the def_lang parameter to modules/files/list.php; the m_path parameter to (2) modules/projects/summary.inc.php or (3) modules/tasks/summary.inc.php; (4) the module parameter to modules/projects/list.php; or the module parameter to index.php in the (5) certinfo, (6) emails, (7) events, (8) fax, (9) files, (10) groupadm, (11) history, (12) info, (13) log, (14) mail, (15) messages, (16) organizations, (17) phones, (18) presence, (19) projects, (20) reports, (21) search, (22) snf, (23) syslog, (24) tasks, or (25) useradm subdirectory of modules/."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de sato de directorio en PHP Project Management 0.8.10 y anteriores permite a atacantes remotos incluir y ejecutar archivos locales de su elecci\u00f3n a trav\u00e9s de una secuencia .. (punto punto) en el par\u00e1metro 1) the def_lang en modules/files/list.php; el par\u00e1metro m_path en (2) modules/projects/summary.inc.php o (3) modules/tasks/summary.inc.php; (4) el par\u00e1metro module en modules/projects/list.php; o el par\u00e1metro module en index.php en los subdirectorios 5) certinfo, (6) emails, (7) events, (8) fax, (9) files, (10) groupadm, (11) history, (12) info, (13) log, (14) mail, (15) messages, (16) organizations, (17) phones, (18) presence, (19) projects, (20) reports, (21) search, (22) snf, (23) syslog, (24) tasks, o (25) useradm de modules/."
    }
  ],
  "id": "CVE-2007-5642",
  "lastModified": "2026-06-16T22:46:33.417",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-10-23T21:47:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41951"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41954"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41955"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41956"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41960"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41963"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41970"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41972"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41974"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/41975"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27347"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/26148"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37348"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.exploit-db.com/exploits/4549"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41951"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41954"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41955"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41956"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41960"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41963"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41970"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41972"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41974"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/41975"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27347"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/26148"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37348"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/4549"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.