Unscored CVE-2007-4181 EUVD-2007-4165GHSA-c345-8824-6347

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to ex…

Published Aug 8, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: A reliable third party disputes this vulnerability because the applicable include is within a function that does not receive the dir parameter from an HTTP request

References

pluck-theme-file-include(35756) vdb-entry
2973 third-party-advisory
20070802 False: Pluck 4.3 themes.php Remote File Inclusion and disclosure mailing-list
20070802 Pluck 4.3 themes.php Remote File Inclusion and disclosure mailing-list
http://outlaw.aria-security.info/?p=12